m0nad / Diamorphine

LKM rootkit for Linux Kernels 2.6.x/3.x/4.x/5.x/6.x (x86/x86_64 and ARM64)
Other
1.82k stars 431 forks source link

Help please. #36

Closed Zibri closed 1 year ago

Zibri commented 2 years ago

Hello! I am writing a kernel module that patches a kernel function on ARM64 (android). The problem is that as I write the 8 bytes I need to write, kernel crashes and reboots. I have seen you are using update_mapping_prot but I don't understand how to use it to make RW the function code.

For example, let's say I want to change 8 bytes in function ip_forward. I get the address to modify in a variable like this:

unsigned long *ff; .......... ff=findcode(); printk("Found code at: %lx\n",ff);

to write it I do: ff[0]=0xd503201fd503201f; // two nops or *ff = 0xd503201fd503201f; // two nops

how can I make the kernel code section where ip_forward is RW before the write?

m0nad commented 1 year ago

This part was written by @awerv, which can help you better.