Diamorphine ported to ARM #27
Conversation
|
Hi! First of all, thank you, I was trying to make Diamorphine to work in my Raspberry Pi 4 I've tried the code you proposed and although I'm not getting that error anymore, my Raspberry crashes when loading the module. I'm using Raspbian and I've tried with kernels 4.19.188, 5.4.51 and 5.4.79 (seems like it skips from 4.19.188 to 5.4.51, so 5.1.0 is not available for me). If anyone wants to help I will be glad to give any debug or additional information. If this is not the right place for this comment, just tell me and I will remove and post it on Issues. I just think this is ok since these changes are the closest I've been to a solution. |
|
@GrizzlyMiki please clone my master branch and compile it as it is, so we can check if the crash is caused by my code, or any modification you might have applied. If my master branch still crashes your Pi, describe please how and where did you compile the rootkit, send me the output of |
|
@awerv I'm running it without any modification. My I compiled the rootkit as "root" under I think I cannot send the full crash report (I guess you are referring to the kernel logs) since this Pi is not logging the events properly (I've been told logging was probably disabled) but I here I leave the full verbose output when trying to load the module with Is that output showing any problem I cannot spot? After that, I'm sure it crashes or reboots since I get a I understand this information might not be enough, if that is the case, I will try to install and configure a logging service (I've been trying today in order to answer to this but I was getting no logs and wanted to answer as soon as possible). Thank you very much for trying and for answering so quickly |
|
@GrizzlyMiki I was trying to test it on my Raspberry Pi 4, but it runs 5.10, so I could not compile Diamorphine for that kernel due to the same issue presented in #26. I'll try with an older kernel, probably by installing Raspbian on a vm. |
|
@awerv Instead of trying to enable the logs I did a clean Raspbian installation and downgraded to kernel 5.4.79. This has logging enabled by default so I can give you a little extra info. Cloned your branch under And I got this in the shell after executing After that, I had to manually restart the Pi. Also tried to update and upgrade and, after downgrading the kernel again (it got updated too), I ran If you want the content of any particular file you just need to tell me, although I'd swear there is no log entry from the load of the module until the new boot. Thanks for your help. |
|
@awerv For a final test I tried to remove |
|
@GrizzlyMiki the issue is not |
|
@GrizzlyMiki I managed to downgrade & crash my Pi with Diamorphine. It turned out, that above kernel version 4.16.0 only some architectures changed the convention how syscalls are called, platforms where |
|
@awerv Sure, I will try it right now. Is it possible that you pushed the wrong version, though? Because I'm getting some compilation errors (I'm cloning from https://github.com/awerv/Diamorphine and my kernel is make[1]: Entering directory '/usr/src/linux-headers-5.4.79-v7l+'
CC [M] /root/Diamorphine/diamorphine.o
/root/Diamorphine/diamorphine.c: In function ‘hacked_getdents64’:
/root/Diamorphine/diamorphine.c:124:28: warning: passing argument 1 of ‘orig_getdents64’ makes pointer from integer without a cast [-Wint-conversion]
int ret = orig_getdents64(fd, dirent, count), err;
^~
/root/Diamorphine/diamorphine.c:124:28: note: expected ‘const struct pt_regs *’ but argument is of type ‘unsigned int’
/root/Diamorphine/diamorphine.c:124:12: error: too many arguments to function ‘orig_getdents64’
int ret = orig_getdents64(fd, dirent, count), err;
^~~~~~~~~~~~~~~
/root/Diamorphine/diamorphine.c: In function ‘hacked_getdents’:
/root/Diamorphine/diamorphine.c:190:26: warning: passing argument 1 of ‘orig_getdents’ makes pointer from integer without a cast [-Wint-conversion]
int ret = orig_getdents(fd, dirent, count), err;
^~
/root/Diamorphine/diamorphine.c:190:26: note: expected ‘const struct pt_regs *’ but argument is of type ‘unsigned int’
/root/Diamorphine/diamorphine.c:190:12: error: too many arguments to function ‘orig_getdents’
int ret = orig_getdents(fd, dirent, count), err;
^~~~~~~~~~~~~
/root/Diamorphine/diamorphine.c: In function ‘hacked_kill’:
/root/Diamorphine/diamorphine.c:330:21: warning: passing argument 1 of ‘orig_kill’ makes pointer from integer without a cast [-Wint-conversion]
return orig_kill(pid, sig);
^~~
/root/Diamorphine/diamorphine.c:330:21: note: expected ‘const struct pt_regs *’ but argument is of type ‘pid_t’ {aka ‘int’}
/root/Diamorphine/diamorphine.c:330:11: error: too many arguments to function ‘orig_kill’
return orig_kill(pid, sig);
^~~~~~~~~
/root/Diamorphine/diamorphine.c: In function ‘diamorphine_init’:
/root/Diamorphine/diamorphine.c:408:19: error: ‘orig_getdents_t’ undeclared (first use in this function); did you mean ‘orig_getdents64’?
orig_getdents = (orig_getdents_t)__sys_call_table[__NR_getdents];
^~~~~~~~~~~~~~~
orig_getdents64
/root/Diamorphine/diamorphine.c:408:19: note: each undeclared identifier is reported only once for each function it appears in
/root/Diamorphine/diamorphine.c:408:35: error: expected ‘;’ before ‘__sys_call_table’
orig_getdents = (orig_getdents_t)__sys_call_table[__NR_getdents];
^~~~~~~~~~~~~~~~
;
/root/Diamorphine/diamorphine.c:409:21: error: ‘orig_getdents64_t’ undeclared (first use in this function); did you mean ‘orig_getdents64’?
orig_getdents64 = (orig_getdents64_t)__sys_call_table[__NR_getdents64];
^~~~~~~~~~~~~~~~~
orig_getdents64
/root/Diamorphine/diamorphine.c:409:39: error: expected ‘;’ before ‘__sys_call_table’
orig_getdents64 = (orig_getdents64_t)__sys_call_table[__NR_getdents64];
^~~~~~~~~~~~~~~~
;
/root/Diamorphine/diamorphine.c:410:15: error: ‘orig_kill_t’ undeclared (first use in this function); did you mean ‘orig_kill’?
orig_kill = (orig_kill_t)__sys_call_table[__NR_kill];
^~~~~~~~~~~
orig_kill
/root/Diamorphine/diamorphine.c:410:27: error: expected ‘;’ before ‘__sys_call_table’
orig_kill = (orig_kill_t)__sys_call_table[__NR_kill];
^~~~~~~~~~~~~~~~
;
scripts/Makefile.build:265: recipe for target '/root/Diamorphine/diamorphine.o' failed
make[2]: *** [/root/Diamorphine/diamorphine.o] Error 1
Makefile:1732: recipe for target '/root/Diamorphine' failed
make[1]: *** [/root/Diamorphine] Error 2
make[1]: Leaving directory '/usr/src/linux-headers-5.4.79-v7l+'
Makefile:7: recipe for target 'all' failed
make: *** [all] Error 2Also tried with kernel 5.4.83-v7l+ and the errors are still there. |
Syscall params modified to match the pt_regs struct of ARM Write protection extended, the set_kernel_text functions cover the syscall table too Above 4.16.0, syscalls still use the legacy interface, unless CONFIG_ARCH_HAS_SYSCALL_WRAPPER is set (only x86, arm64 & s390) Tested on 5.1.0 armv7l & raspberrypi 5.4.83-v7l+
|
@GrizzlyMiki 1 |
|
@awerv Been testing on kernel 5.4.83-v7l+ and it works fine now, although I would recommend you to check the "Sending a signal 64(to any pid) makes the given user become root" functionality since it wasn't working for me. To be clear I don't need that specific functionality, so for me in particular this is not important. I was checking it by running Thank you very much for your work, I kind of needed to get this to work and I couldn't have done it myself ^^ |
|
@GrizzlyMiki glad I could help, and thank you for uncovering my mistake :) The shell got escalated, however the file is created with the id of the old user. |
|
Thanks for your contribution - again - @awerv, and thanks @GrizzlyMiki for helping with this. I also tested on 5.10 using the kprobe technique to fix the kallsyms_lookup_name non-exported symbol but got a crash. |
|
Sorry for the inactivity, I had a couple of busy weeks, but I didn't forget this, will look into the issue in the near future. |
|
Hi @awerv, do you still plan to work on this? |
|
Yes, I intend to. Hopefully this or the next weekend I will have time to work on this. |
|
Hey @m0nad! I finally did some investigation, but I couldn't replicate your crash.
I don't think this config option has anything to do with your crash... |
|
@awerv hi! I am trying to write a kernel module for android (linux kernel 4.14.180-190 on ARM64) and I need to patch a couple of bytes in KERNEL code area. Can you help? |
|
@Zibri check the code of the boot flow, somewhere there the kernel marks its memory read-only. That's how I found |
|
@awerv I didn't find a solution.. or I would not have asked you. |
Syscall params modified to match the pt_regs struct of ARM
Write protection extended, the set_kernel_text functions cover the syscall table too
Tested on 5.1.0 armv7l