本帖最後由 djpvd 於 2019-9-18 10:13 編輯
模塊 vermagic 繞過補釘
kernel/module.c
* 找到函數 check_version
- static int check_version(Elf_Shdr *sechdrs,
- unsigned int versindex,
- const char *symname,
- struct module *mod,
- const unsigned long *crc,
- const struct module *crc_owner)
- {
- unsigned int i, num_versions;
- struct modversion_info *versions;
- /* Exporting module didn"t supply crcs? OK, we"re already tainted. */
- if (!crc)
- return 1;
- /* No versions at all? modprobe --force does this. */
- if (versindex == 0)
- return try_to_force_load(mod, symname) == 0;
- versions = (void *) sechdrs[versindex].sh_addr;
- num_versions = sechdrs[versindex].sh_size
- / sizeof(struct modversion_info);
- for (i = 0; i < num_versions; i++) {
- if (strcmp(versions[i].name, symname) != 0)
- continue;
- if (versions[i].crc == maybe_relocated(*crc, crc_owner))
- return 1;
- pr_debug("Found checksum %lX vs module %lX
- ",
- maybe_relocated(*crc, crc_owner), versions[i].crc);
- goto bad_version;
- }
- printk(KERN_WARNING "%s: no symbol version for %s
- ",
- mod->name, symname);
- return 0;
- bad_version:
- printk("%s: disagrees about version of symbol %s
- ",
- mod->name, symname);
- return 0;
- }
複製代碼
改成
- static int check_version(Elf_Shdr *sechdrs,
- unsigned int versindex,
- const char *symname,
- struct module *mod,
- const unsigned long *crc,
- const struct module *crc_owner)
- {
- return 1;
- }
複製代碼
* 找到函數 check_modstruct_version
- static inline int check_modstruct_version(Elf_Shdr *sechdrs,
- unsigned int versindex,
- struct module *mod)
- {
- const unsigned long *crc;
- /* Since this should be found in kernel (which can"t be removed),
- * no locking is necessary. */
- if (!find_symbol(VMLINUX_SYMBOL_STR(module_layout), NULL,
- &crc, true, false))
- BUG();
- return check_version(sechdrs, versindex,
- VMLINUX_SYMBOL_STR(module_layout), mod, crc,
- NULL);
- }
複製代碼
改成
- static inline int check_modstruct_version(Elf_Shdr *sechdrs,
- unsigned int versindex,
- struct module *mod)
- {
- return 1;
- }
複製代碼
* 找到函數 check_modinfo
static int check_modinfo
將以下內容刪除或註解掉
- int err;
- /* This is allowed: modprobe --force will invalidate it. */
- if (!modmagic) {
- err = try_to_force_load(mod, "bad vermagic");
- if (err)
- return err;
- } else if (!same_magic(modmagic, vermagic, info->index.vers)) {
- printk(KERN_ERR "%s: version magic "%s" should be "%s"
- ",
- mod->name, modmagic, vermagic);
- return -ENOEXEC;
- }
複製代碼
* 找到函數 try_to_force_load
整段刪除或註解掉。
- static int try_to_force_load(struct module *mod, const char *reason)
- {
- #ifdef CONFIG_MODULE_FORCE_LOAD
- if (!test_taint(TAINT_FORCED_MODULE))
- printk(KERN_WARNING "%s: %s: kernel tainted.
- ",
- mod->name, reason);
- add_taint_module(mod, TAINT_FORCED_MODULE, LOCKDEP_NOW_UNRELIABLE);
- return 0;
- #else
- return -ENOEXEC;
- #endif
- }
複製代碼
這樣一來才能自由添加驅動模塊。
|