3

I am writing a rootkit for my OS class (the teacher is okay with me asking for help here). My rootkit hooks the sys_read system call to hide "magic" ports from the user. When I copy the user buffer *buf (one of the arguments of sys_read) to kernel space (into a buffer called kbuf) I get kernel panic/core dump error. It is possible that this is just because breaking read brings the system to a halt, but I wonder if anyone has any perspective on this.

The code is available online. Look at line 207: https://github.com/joshimhoff/toykit/blob/master/toykit.c

I hooked getdents and used copy_from_user to bring the getdents structs into kernel space, and this worked well! I am not sure what is different about read.

Thanks for the help!

Josh Imhoff
  • 6,746
  • 3
  • 13
  • 10

1 Answers1

1

I figured it out. I called the actual sys_read function and didn't check the return value. Sometimes it is negative to indicate an error. Instead of failing early, I asked kmalloc for a negative number of bytes.

Imagine that. Allocating negative memory. That would be a crazy world.

Josh Imhoff
  • 6,746
  • 3
  • 13
  • 10