Quantcast
Channel: windows deep internals
Browsing latest articles
Browse All 272 View Live

kotest fix for mips

kotest refused to count string literals for MIPS kernel modules. Reason was in that gcc does not put sizes/object types of unnamed string literals - it looks in asm files like$LC0:        .ascii...

View Article


Image may be NSFW.
Clik here to view.

stack frames size in DWARF

As you might suspect, the stack size in the kernel is quite meager so it's very important to know how much of stack occupy your driver. So I conducted inhumane experiments on my own driver lkcd to...

View Article


function stack size in GCC

Let's continue our wandering in endless dead endGCC has struct stack_usage and even field su inside struct function. And this last is accessible as global var cfun. So it's should be easy to patch...

View Article

frame sizes in dwarfdump

Add today dumping of stack frame sizes to my dwarfdump (well, where they are exists). Format of .debug_frame section obviously was invented by martian misantrophes so patch is huge and uglySample of...

View Article

Image may be NSFW.
Clik here to view.

dumping ebpf kind_ops

Very funny article about (im)possible future of ebpf. Given that right now 8 small BPF scripts with only 7 opcodes occupy 1Mb whole kernel on ebpf will require exabytes of RAM, he-heAnyway there is...

View Article


Image may be NSFW.
Clik here to view.

ebpf map as communication channel

Recently I've done small research to repurpose overvalued ebpf into something useful and even achieved some modest results. It seems that at least you can use ebpf maps in your old-school native...

View Article

moving string literals to discardable sections

As kotest shows we can achieve reduction in the size of non-discardable sections of LKMs (and thus reduce total size of memory occupied by kernel) with moving constants used in functions from...

View Article

Image may be NSFW.
Clik here to view.

crowdstrike

since everyone (including"professional C++ programmers") has already written about so I will also write it down (for memory)This was not first time: proofOfficial report is very vague but we can...

View Article


bpf_verifier_ops

Lets dissect some typical ebpf spyware. It sets up uprobes onSSL_read_exSSL_readSSL_write_exSSL_writegotls_write_register gotls_read_registergotls_exit_read_registerand uses bpf functions...

View Article


Image may be NSFW.
Clik here to view.

hidden executable pages in linux kernel

Standard method to find rootkits like this (or like this) is cross-scanning PTEs of memory without NX bit, then extract pages belonging to LKMs - thus in set difference we will gather hidden executable...

View Article

hidden executable pages in linux kernel, part 2

In part 1 I've described how memory managed by hardware. Now lets dig into how kernel sees memory. Not surprisingly that we should check the same structures that malicious drivers update while...

View Article

bug in gcc?

It seems that gcc not always put COMPONENT_REF when access fields of structures passed by reference. For example I add today simple static function append_name(aux_type_clutch&clutch, const char...

View Article

Tracking arguments of functions in gcc

I continuing to improve my gcc plugin for collecting cross-references: 1, 2, 3, 4, 5, 6& 7. On this week I decided to see if I can extract source of complex types like records and most prominent...

View Article


gcc plugin to collect cross-references, part 9

Lets extract some useful results from my gcc plugin for collecting cross-references: 1, 2, 3, 4, 5, 6, 7& 8. I've noticed that plugin worked unbearably slowly on big source files (like compiling...

View Article

TLS in gcc RTL

Lets check how TLS looks like in RTL. I wrote simple test:(insn 29 8 10 3 (set (reg:SI 0 ax [orig:82 _1 ] [82])        (mem/c:SI (const:DI (unspec:DI [                        (symbol_ref:DI...

View Article


binding c++ objects to perl

Sure there are lots of ways to do this (as usually in Perl: "there's more than one way to do it"), just to name few:swig - result looks not native and clumsy, also you need to make facade-like...

View Article

perl module for DWARF debug info parsing

I've made perl binding of my c++ dwarf dumper. Supports 64/32 bit, no DWO, don't sure if it can load arbitrary object files but at least can parse LKM - I even added relocations processingMaybe one day...

View Article


perl module for powerpc disasm

It seems that there are no good open-source disasm for PPC except Capstone. And it even has perl binding - unfortunately it can extract only basic fields like opcode and text but no operands for...

View Article

ptx internals

It seems that syntax of PTX is undocumented - at least I was unable to find actual BNF grammar or reference implementation. Grammar from antlr project is greatly out-dated and don't contain...

View Article

nvidia sass disassembler

Couple weeks ago I made decryptor to extract from nvdisasm so called "machine descriptions" (MD) (btw nvdisasm v12 uses lz4 compression library, so I made yet another decryptor + results). And after...

View Article

nvidia sass disassembler, part 2

Lets continue explore "machine descriptions" - in this time try to understand how to make format output more similar to genuine nvdisasmFor example format for one of variant I2F looks like: FORMAT...

View Article


nvidia sass disassembler, part 3

It looks like this rabbit hole goes much deeperSome const banks does not have ConstBankAddressX:CX:Sb[UniformRegister:URb][UImm(16)*:Sb_offset]BITS_6_37_32_Ra_URb=URbBITS_14_53_40_Sb_offset=Sb_offset...

View Article


Image may be NSFW.
Clik here to view.

nvidia sass disassembler, part 4

I've made native sass disasm - just adding c++ codegen (can be produced by ead.pl with -C option). It works via dynamic loading of right disasm module - see list of supported architectures in map...

View Article

nvidia sass disassembler, part 5

Previous parts: 1, 2, 3& 4I've finally add native rendering for instructions - actually just rewrite from perl terrible function make_inst. Because in output typically rendering only small fraction...

View Article

ptx instructions emitting by nvidia compiler

I recently became curious what exactly ptx instructions can produce nvidia compiler - like if it uses something totally undocumented or vice versa - some official ptx instructions are never generated...

View Article

Browsing latest articles
Browse All 272 View Live


<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>