Linux_kernel_module_cheat_presentation.srt

1
00:00:00,000 --> 00:00:02,000
Linux kernel module cheat.

2
00:00:02,000 --> 00:00:04,000
So a GitHub project, yeah.

3
00:00:04,000 --> 00:00:07,000
The goal for this project is to have the perfect emulation setup.

4
00:00:07,000 --> 00:00:12,000
So you run Linux on a virtual machine to understand and debug it.

5
00:00:12,000 --> 00:00:14,000
And it can be very useful for security people.

6
00:00:14,000 --> 00:00:15,000
How does it work?

7
00:00:15,000 --> 00:00:18,000
You can use a simulator to run it very fast and it's very cool.

8
00:00:18,000 --> 00:00:21,000
So first you run some random commands.

9
00:00:21,000 --> 00:00:22,000
These are the commands.

10
00:00:22,000 --> 00:00:24,000
And this gives you a Docker.

11
00:00:24,000 --> 00:00:28,000
I've just tested it on Ubuntu 24.04.

12
00:00:28,000 --> 00:00:30,000
And after you get this Docker, once you reach the point,

13
00:00:30,000 --> 00:00:33,000
everything will work for sure because we are in Docker, right?

14
00:00:33,000 --> 00:00:34,000
Hopefully.

15
00:00:34,000 --> 00:00:37,000
So after you reach that point, you run this command.

16
00:00:37,000 --> 00:00:41,000
This builds everything from source.

17
00:00:41,000 --> 00:00:45,000
So QEMU, Linux kernel, glibc, shell, everything.

18
00:00:45,000 --> 00:00:47,000
And then you do run.

19
00:00:47,000 --> 00:00:53,000
And after you do run, Linux boots, and you end up in the shell.

20
00:00:53,000 --> 00:00:55,000
So here I run pwd command.

21
00:00:55,000 --> 00:01:00,000
So a Linux shell provided by Buildroot, shell thingy, Busybox.

22
00:01:00,000 --> 00:01:03,000
So far it's not too exciting, but what is exciting about this,

23
00:01:03,000 --> 00:01:07,000
in my opinion, is that everything is built from source.

24
00:01:07,000 --> 00:01:09,000
And I mean everything.

25
00:01:09,000 --> 00:01:10,000
There are no blobs.

26
00:01:10,000 --> 00:01:12,000
So QEMU is built from source.

27
00:01:12,000 --> 00:01:14,000
Linux kernel is built from source.

28
00:01:14,000 --> 00:01:17,000
glibc, GCC, everything is built from source.

29
00:01:17,000 --> 00:01:19,000
So it's extremely clean.

30
00:01:19,000 --> 00:01:24,000
And for the most important projects, I even have them as submodules of my project.

31
00:01:24,000 --> 00:01:29,000
So you can just, you know, you have them, git tracked, all the sources there.

32
00:01:29,000 --> 00:01:31,000
You can just modify things very easily.

33
00:01:31,000 --> 00:01:33,000
So for example, do you want to modify the Linux kernel?

34
00:01:33,000 --> 00:01:34,000
No problem.

35
00:01:34,000 --> 00:01:38,000
You go to this function, say you want to modify the start kernel function,

36
00:01:38,000 --> 00:01:39,000
which runs at boot time.

37
00:01:39,000 --> 00:01:41,000
Let's put a print there.

38
00:01:41,000 --> 00:01:43,000
Then you do ./build-linux

39
00:01:43,000 --> 00:01:45,000
Then you do ./run

40
00:01:45,000 --> 00:01:47,000
And there it is.

41
00:01:47,000 --> 00:01:48,000
It will show up there.

42
00:01:48,000 --> 00:01:51,000
This build was really fast because it was a differential build.

43
00:01:51,000 --> 00:01:53,000
You can see that you can really modify things.

44
00:01:53,000 --> 00:01:57,000
Another really cool thing about having the source lying around,

45
00:01:57,000 --> 00:02:00,000
is that we can use GDB step debugging very easily.

46
00:02:00,000 --> 00:02:03,000
So for example, if you wanted to GDB step debut the Linux kernel,

47
00:02:03,000 --> 00:02:06,000
and let's say you want to debug the start_kernel function now,

48
00:02:06,000 --> 00:02:09,000
instead of just putting a print, we're going to put GDB there.

49
00:02:09,000 --> 00:02:10,000
We can.

50
00:02:10,000 --> 00:02:13,000
So you just ./run --gdb-wait

51
00:02:13,000 --> 00:02:16,000
./run-gdb start_kernel in another shell.

52
00:02:16,000 --> 00:02:20,000
And after boot, which is really fast on QEMU, just a few seconds.

53
00:02:20,000 --> 00:02:22,000
BANG! you get a GDB shell.

54
00:02:22,000 --> 00:02:28,000
And you can do common GDB things like go to the next line, list, bt.

55
00:02:28,000 --> 00:02:30,000
Everything basically just works.

56
00:02:30,000 --> 00:02:32,000
Multiple architectures are supported.

57
00:02:32,000 --> 00:02:34,000
So you can change the architecture.

58
00:02:34,000 --> 00:02:35,000
Super easy.

59
00:02:35,000 --> 00:02:38,000
Just say, oh, the architecture is aarch64.

60
00:02:38,000 --> 00:02:40,000
And now run the architecture aarch64.

61
00:02:40,000 --> 00:02:42,000
And it also just works.

62
00:02:42,000 --> 00:02:46,000
And I also have a lot of more content oriented things in this repo,

63
00:02:46,000 --> 00:02:49,000
because I use it whenever I want to test something that is related to emulation.

64
00:02:49,000 --> 00:02:51,000
I just dumped it there.

65
00:02:51,000 --> 00:02:53,000
So, okay, we have kernel modules.

66
00:02:53,000 --> 00:02:56,000
as the name of the project indicates.

67
00:02:56,000 --> 00:03:00,000
So, for example, hello.c is a kernel module.

68
00:03:00,000 --> 00:03:02,000
Just like the Linux kernel, build

69
00:03:02,000 --> 00:03:03,000
re-run

70
00:03:03,000 --> 00:03:04,000
And BANG! there it is.

71
00:03:04,000 --> 00:03:07,000
I also learned a lot of assembly through this product.

72
00:03:07,000 --> 00:03:10,000
So I made minimal examples.

73
00:03:10,000 --> 00:03:13,000
For example, let's learn the ADD instruction of x86.

74
00:03:13,000 --> 00:03:15,000
One plus one equals three assertion.

75
00:03:15,000 --> 00:03:17,000
This is just an userland example.

76
00:03:17,000 --> 00:03:19,000
But because you need emulation to learn assembly,

77
00:03:19,000 --> 00:03:23,000
it is very convenient to put everything in this one place and just run it there.

78
00:03:23,000 --> 00:03:24,000
It's very clean.

79
00:03:24,000 --> 00:03:28,000
And another thing that I did in this project as well is even bare metal.

80
00:03:28,000 --> 00:03:31,000
Of course, this is unrelated to Linux kernel,

81
00:03:31,000 --> 00:03:34,000
but it's just kind of cool and also emulation focused.

82
00:03:34,000 --> 00:03:40,000
So I also have some bare metal examples that you can learn bare metal features as well.