Comprehensive list of kernel self-modifications?

Comprehensive list of kernel self-modifications?

[Yan]

Hello,

I have been working on verifying kernel integrity and am trying to
differentiate
between vmlinux image on disk and the kernel loaded into memory. I understand
 that the kernel modifies itself (on x86 at least) during at least a few points:


1. It applies alternative instructions with apply_alternatives() from
check_bugs().
    The locations of all alternatives are found between __alt_instructions and
    __alt_instructions__end.
2. It also applies what looks to be relocation. I see the list of
reloc addresses at
    the end of vmlinux image and it appears that relocate_kernel in
relocate_kernel.S
    applies the relocations. I can't tell how it knows where the list
of addresses that
    need relocations is found. Nothing that I found points to that
area, and the on-
    disk data seems to live what gets mapped to as BSS when its running.
3. After manual inspection of all the relocs and alternatives, theres
still about 120
    bytes different. The data looks like groups of 3bytes+address tuples.

Most of this was found via trial and error, so I'm sure there are
other cases of
self-modification. Can anyone point me to a comprehensive list of everywhere
that a kernel can change its own text? Or if anyone knows off the top of their
head, that would be helpful too.

P.S. Please CC to me as I am not subscribed to the list.


Thank you in advance,
Yan

Re: Comprehensive list of kernel self-modifications?

[Chris Wright]

* Yan (rottled@gmail.com) wrote:
> I have been working on verifying kernel integrity and am trying to
> differentiate
> between vmlinux image on disk and the kernel loaded into memory. I understand
>  that the kernel modifies itself (on x86 at least) during at least a few points:
> 
> 
> 1. It applies alternative instructions with apply_alternatives() from
> check_bugs().
>     The locations of all alternatives are found between __alt_instructions and
>     __alt_instructions__end.

Similarly, there's apply_paravirt() for CONFIG_PARAVIRT kernels.
(Also kprobes, or anything that calls text_poke(), but I doubt it's what
you're looking for).

> 2. It also applies what looks to be relocation. I see the list of
> reloc addresses at
>     the end of vmlinux image and it appears that relocate_kernel in
> relocate_kernel.S
>     applies the relocations. I can't tell how it knows where the list
> of addresses that
>     need relocations is found. Nothing that I found points to that
> area, and the on-
>     disk data seems to live what gets mapped to as BSS when its running.

BSS?  It's not on disk outside of elf header and mapped and cleared at
startup (see clear_bss, for example).

Re: Comprehensive list of kernel self-modifications?

[Pavel Machek]

Hi!

> I have been working on verifying kernel integrity and am trying to
> differentiate
> between vmlinux image on disk and the kernel loaded into memory. I understand
>  that the kernel modifies itself (on x86 at least) during at least a few points:

This should go into Doc*/ somewhere. Self-modifying code just loves
provoking cpu bugs...
							Pavel
-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html