search for: query_module

...ind. Because such tools are likely to be in use within the hacker community already, I decided to publish a piece of code to demonstrate the potentials of a malicious module. The following piece of code is a fully working Linux module for 2.1 kernels that patches the getdents(), kill(), read() and query_module() calls. Once loaded, the module becomes invisible to lsmod and a dump of /proc/modules by modifying the output of every query_module() call and every read() call accessing /proc/modules. Apparently rmmod also calls query_module() to list all modules before attempting to remove the specified module...

...klibc-0.70/klibc/SYSCALLS klibc-0.70+insmod/klibc/SYSCALLS --- klibc-0.70/klibc/SYSCALLS 2002-09-11 07:00:58.000000000 +0200 +++ klibc-0.70+insmod/klibc/SYSCALLS 2002-12-20 01:05:35.000000000 +0100 @@ -142,5 +142,6 @@ void * create_module(const char *, size_t) int delete_module(const char *) int query_module(const char *, int, void *, size_t, size_t) +long init_module(void *, unsigned long, const char *) int reboot::__reboot(int, int, int, void *) int syslog::klogctl(int, char *, int) Binary files klibc-0.70/utils/insmod and klibc-0.70+insmod/utils/insmod differ diff -urN klibc-0.70/utils/insmod.c kl...

...int sethostname(const char *, size_t) -int init_module(const char *, struct module *) -<!ia64> void * create_module(const char *, size_t) -int delete_module(const char *) +long init_module(void *, unsigned long, const char *) +long delete_module(const char *, unsigned int) <!ia64> int query_module(const char *, int, void *, size_t, size_t) int reboot::__reboot(int, int, int, void *) int syslog::klogctl(int, char *, int) ===== klibc/klibc/syscommon.h 1.1 vs edited ===== --- klibc/klibc/syscommon.h Wed Oct 22 19:37:34 2003 +++ klibc/klibc/syscommon.h Wed Nov 26 16:29:06 2003 @@ -15,7 +15,6 @...

...tify SYSCALL FOUND: pwritev SYSCALL FOUND: quotactl SYSCALL FOUND: epoll_ctl SYSCALL FOUND: tuxcall SYSCALL FOUND: setresuid SYSCALL FOUND: mincore SYSCALL FOUND: rt_sigreturn SYSCALL FOUND: restart_syscall SYSCALL FOUND: process_vm_readv SYSCALL FOUND: vhangup SYSCALL FOUND: oldstat SYSCALL FOUND: query_module SYSCALL FOUND: pread64 SYSCALL FOUND: renameat SYSCALL FOUND: clock_getres SYSCALL FOUND: exit_group SYSCALL FOUND: lsetxattr SYSCALL FOUND: inotify_init SYSCALL FOUND: mount SYSCALL FOUND: wait4 SYSCALL FOUND: ftime SYSCALL FOUND: clone SYSCALL FOUND: select SYSCALL FOUND: syslog SYSCALL FOUND: ge...

On Tue, Aug 20, 2013 at 07:44:39AM +0200, leroy christophe wrote: > > > Find attached two patches I have in order to build klibc 2.0.2 > against kernel 3.8.13 > We had to introduce those patches when going from kernel 3.6 to kernel 3.7 > Hope it helps. > those patches are wrong and again very brittle. just use the way it is described in `make help': A) cd ~/src/linux