-
Notifications
You must be signed in to change notification settings - Fork 1
/
inspection.c
492 lines (413 loc) · 14.9 KB
/
inspection.c
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
/*****************************************************************************
* Copyright 2021 Emisilve86 *
* *
* Licensed under the Apache License, Version 2.0 (the "License"); *
* you may not use this file except in compliance with the License. *
* You may obtain a copy of the License at *
* *
* http://www.apache.org/licenses/LICENSE-2.0 *
* *
* Unless required by applicable law or agreed to in writing, software *
* distributed under the License is distributed on an "AS IS" BASIS, *
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. *
* See the License for the specific language governing permissions and *
* limitations under the License. *
*****************************************************************************/
#ifdef CONFIG_X86_64
#include <linux/version.h>
#include <linux/module.h>
#ifdef CONFIG_KALLSYMS
#include <linux/kallsyms.h>
#endif
#include <linux/slab.h>
#include <asm/desc.h>
#include <asm/desc_defs.h>
#if LINUX_VERSION_CODE >= KERNEL_VERSION(5,8,0)
#include <asm/trapnr.h>
#else
#include <asm/traps.h>
#endif
#include <asm/irq_vectors.h>
#include <asm/io.h>
#include <asm/page.h>
#include <asm/pgtable_types.h>
#define MAX_LEVEL 5
#define SEQUENCE_MAX_BYTES 16392
#define BUFFER_SIZE 128
#define ADDRESS_MASK 0xfffffffffffff000
#define PAGE_TABLE_ADDRESS phys_to_virt(__read_cr3() & ADDRESS_MASK)
#define PT_ADDRESS_MASK 0x7ffffffffffff000
#define VALID 0x1
#define LH_MAPPING 0x80
#define PML4(addr) (((long long)(addr) >> 39) & 0x1ff)
#define PDP(addr) (((long long)(addr) >> 30) & 0x1ff)
#define PDE(addr) (((long long)(addr) >> 21) & 0x1ff)
#define PTE(addr) (((long long)(addr) >> 12) & 0x1ff)
struct idt_entry_info {
char *name;
unsigned short index;
unsigned long address;
} __attribute__((packed));
typedef struct idt_entry_info entry_info;
static entry_info *idt_entries;
static const char *idt_entry_names[NR_VECTORS] = {
[X86_TRAP_DE] = "Divide-by-zero", /* 0 */
[X86_TRAP_DB] = "Debug", /* 1 */
[X86_TRAP_NMI] = "Non-maskable Interrupt", /* 2 */
[X86_TRAP_BP] = "Breakpoint", /* 3 */
[X86_TRAP_OF] = "Overflow", /* 4 */
[X86_TRAP_BR] = "Bound Range Exceeded", /* 5 */
[X86_TRAP_UD] = "Invalid Opcode", /* 6 */
[X86_TRAP_NM] = "Device Not Available", /* 7 */
[X86_TRAP_DF] = "Double Fault", /* 8 */
[X86_TRAP_OLD_MF] = "Coprocessor Segment Overrun", /* 9 */
[X86_TRAP_TS] = "Invalid TSS", /* 10 */
[X86_TRAP_NP] = "Segment Not Present", /* 11 */
[X86_TRAP_SS] = "Stack Segment Fault", /* 12 */
[X86_TRAP_GP] = "General Protection Fault", /* 13 */
[X86_TRAP_PF] = "Page Fault", /* 14 */
[X86_TRAP_SPURIOUS] = "Spurious Interrupt", /* 15 */
[X86_TRAP_MF] = "x87 Floating-Point Exception", /* 16 */
[X86_TRAP_AC] = "Alignment Check", /* 17 */
#ifdef CONFIG_X86_MCE
[X86_TRAP_MC] = "Machine Check", /* 18 */
#endif
[X86_TRAP_XF] = "SIMD Floating-Point Exception", /* 19 */
#if LINUX_VERSION_CODE >= KERNEL_VERSION(5,10,0)
[X86_TRAP_VE] = "Virtualization Exception", /* 20 */
[X86_TRAP_CP] = "Control Protection Exception", /* 21 */
#endif
#if LINUX_VERSION_CODE >= KERNEL_VERSION(5,10,0)
[X86_TRAP_VC] = "VMM Communication Exception", /* 29 */
#endif
[IRQ_MOVE_CLEANUP_VECTOR] = "IRQ Move Cleanup", /* 32 */
[48 ... 63] = "ISA Interrupt", /* 48 ... 63 */
[IA32_SYSCALL_VECTOR] = "IA32 Syscall", /* 128 */
[LOCAL_TIMER_VECTOR] = "Local APIC Timer Interrupt", /* 236 */
#if IS_ENABLED(CONFIG_HYPERV)
[HYPERV_STIMER0_VECTOR] = "Hypervisor STimer0 Interrupt", /* 237 */
[HYPERV_REENLIGHTENMENT_VECTOR] = "Hypervisor Re-enlightement Interrupt", /* 238 */
#endif
[MANAGED_IRQ_SHUTDOWN_VECTOR] = "Managed IRQ Shutdown", /* 239 */
#ifdef CONFIG_HAVE_KVM
[POSTED_INTR_NESTED_VECTOR] = "Posted Interrupt Nested", /* 240 */
[POSTED_INTR_WAKEUP_VECTOR] = "Posted Interrupt Wakeup", /* 241 */
[POSTED_INTR_VECTOR] = "Posted Interrupt", /* 242 */
#endif
[HYPERVISOR_CALLBACK_VECTOR] = "Hypervisor Interrupt", /* 243*/
[DEFERRED_ERROR_VECTOR] = "Deferred Error Interrupt", /* 244 */
[UV_BAU_MESSAGE] = "UV BAU Message", /* 245 */
[IRQ_WORK_VECTOR] = "IRQ Work", /* 246 */
[X86_PLATFORM_IPI_VECTOR] = "x86 Platform IPI", /* 247 */
[REBOOT_VECTOR] = "Reboot Interrupt", /* 248 */
[THRESHOLD_APIC_VECTOR] = "Threshold APIC Interrupt", /* 249 */
[THERMAL_APIC_VECTOR] = "Thermal APIC Interrupt", /* 250 */
[CALL_FUNCTION_SINGLE_VECTOR] = "Call Function Single Interrupt", /* 251 */
[CALL_FUNCTION_VECTOR] = "Call Function Interrupt", /* 252 */
[RESCHEDULE_VECTOR] = "Reschedule INterrupt", /* 253 */
[ERROR_APIC_VECTOR] = "Error APIC Interrupt", /* 254 */
[SPURIOUS_APIC_VECTOR] = "Spurious APIC Interrupt", /* 255 */
};
unsigned int disassemble(unsigned char *bytes, unsigned int max, int offset, char *output);
static long resolve_jmp_address(unsigned char *byte, unsigned int count)
{
unsigned int rip;
unsigned int operand;
if (byte[0] == 0xE9 && count == 5) /* jmp imm32 */
{
rip = (unsigned int) (((unsigned long) &byte[count]) & 0xffffffffUL);
operand = ((unsigned int) byte[1]) | (((unsigned int) byte[2]) << 8) |
(((unsigned int) byte[3]) << 16) | (((unsigned int) byte[4]) << 24);
if ((1U << 31) & operand)
{
operand = (1U << 31) - (operand & ~(1U << 31));
return ((long) (rip - operand)) | ~(0xffffffffL);
}
else
{
return ((long) (rip + operand)) | ~(0xffffffffL);
}
}
else if (byte[0] == 0xEB && count == 2) /* jmp imm8 */
{
rip = (unsigned int) (((unsigned long) &byte[count]) & 0xffffffffUL);
operand = ((unsigned int) byte[1]) & 0xff;
if ((1U << 7) & operand)
{
operand = (1U << 7) - (operand & ~(1U << 7));
return ((long) (rip - operand)) | ~(0xffffffffL);
}
else
{
return ((long) (rip + operand)) | ~(0xffffffffL);
}
return (((long) &byte[count]) + (long) operand) | ~(0xffffffffUL); /* RIP + operand */
}
else
{
return 0;
}
}
static long resolve_call_address(unsigned char *byte, unsigned int count)
{
unsigned int rip;
unsigned int operand;
if (byte[0] == 0xE8 && count == 5) /* call imm32 */
{
rip = (unsigned int) (((unsigned long) &byte[count]) & 0xffffffffUL);
operand = ((unsigned int) byte[1]) | (((unsigned int) byte[2]) << 8) |
(((unsigned int) byte[3]) << 16) | (((unsigned int) byte[4]) << 24);
if ((1U << 31) & operand)
{
operand = (1U << 31) - (operand & ~(1U << 31));
return ((long) (rip - operand)) | ~(0xffffffffL);
}
else
{
return ((long) (rip + operand)) | ~(0xffffffffL);
}
}
else
{
return 0;
}
}
static int check_page_is_valid_get_frame_number(unsigned long address)
{
void *target_address;
pud_t *pdp;
pmd_t *pde;
pte_t *pte;
pgd_t *pml4;
int frame_number;
unsigned long frame_addr;
target_address = (void *) address;
pml4 = PAGE_TABLE_ADDRESS;
if(!(((ulong)(pml4[PML4(target_address)].pgd)) & VALID))
return -1;
pdp = __va((ulong)(pml4[PML4(target_address)].pgd) & PT_ADDRESS_MASK);
if(!((ulong)(pdp[PDP(target_address)].pud) & VALID))
return -1;
pde = __va((ulong)(pdp[PDP(target_address)].pud) & PT_ADDRESS_MASK);
if(!((ulong)(pde[PDE(target_address)].pmd) & VALID))
return -1;
if((ulong)pde[PDE(target_address)].pmd & LH_MAPPING)
{
frame_addr = (ulong)(pde[PDE(target_address)].pmd) & PT_ADDRESS_MASK;
frame_number = frame_addr >> 12;
return frame_number;
}
pte = __va((ulong)(pde[PDE(target_address)].pmd) & PT_ADDRESS_MASK);
if(!((ulong)(pte[PTE(target_address)].pte) & VALID))
return -1;
frame_addr = (ulong)(pte[PTE(target_address)].pte) & PT_ADDRESS_MASK;
frame_number = frame_addr >> 12;
return frame_number;
}
static void binary_inspection(entry_info *idt_entry)
{
unsigned int b;
unsigned int e;
unsigned int count;
unsigned int level = 0;
#ifdef CONFIG_KALLSYMS
int symbol_size;
char symbol_buffer[BUFFER_SIZE];
#endif
unsigned char instruction[BUFFER_SIZE];
unsigned char disassembled[BUFFER_SIZE];
unsigned char *byte;
unsigned long level_address[MAX_LEVEL + 1] = { 0UL };
unsigned char prefix[MAX_LEVEL + 2];
if (idt_entry && idt_entry->address)
{
if (idt_entry->name)
{
pr_info("[Interrupt Handler Binary Inspection] : Binary inspection starting from the \"%s\" routine (IDT index: %hu)", idt_entry->name, idt_entry->index);
}
#ifdef CONFIG_KALLSYMS
else if ((symbol_size = sprint_symbol(symbol_buffer, idt_entry->address)) > 0)
{
pr_info("[Interrupt Handler Binary Inspection] : Binary inspection starting from the \"%s\" routine (IDT index: %hu)", symbol_buffer, idt_entry->index);
}
#endif
else
{
pr_info("[Interrupt Handler Binary Inspection] : Binary inspection starting from a routine with unknown name (IDT index: %hu)", idt_entry->index);
}
if (check_page_is_valid_get_frame_number(idt_entry->address) == -1)
{
pr_err("[Interrupt Handler Binary Inspection] : The address stored within the IDT entry with index %hu is in a non-mapped page\n", idt_entry->index);
return;
}
level_address[level] = idt_entry->address;
level_switch:
for (b=0; b<=level; b++)
{
prefix[b] = '-';
}
prefix[b] = '\0';
follow_jump:
byte = (unsigned char *) level_address[level];
for (b=0, count=0; b<SEQUENCE_MAX_BYTES; b+=count)
{
count = disassemble(&byte[b], SEQUENCE_MAX_BYTES - b, ((unsigned int) (((unsigned long) &byte[b]) & 0xffffffffUL)), disassembled);
instruction[0] = '\0';
for (e=0; e<count; e++)
{
sprintf(instruction + strlen(instruction), "%02x ", byte[b + e]);
}
pr_info("%s %08x: %-24s %s", prefix, ((unsigned int) (((unsigned long) &byte[b]) & 0xffffffffUL)), instruction, disassembled);
if (byte[b] == 0xC2 || byte[b] == 0xC3 || byte[b] == 0xCA || byte[b] == 0xCB || byte[b] == 0xCF) // RET
{
if (level)
{
level_address[level--] = 0UL;
goto level_switch;
}
pr_info("[Interrupt Handler Binary Inspection] : Binary inspection finished\n");
break;
}
else if (byte[b] == 0xE9 || byte[b] == 0xEA || byte[b] == 0xEB) // JMP
{
long jmp_address = resolve_jmp_address(&byte[b], count);
if (jmp_address)
{
unsigned char *jmp_opcode = (unsigned char *) (*((unsigned long *) &jmp_address));
if (jmp_opcode[0] == 0xF2 || jmp_opcode[0] == 0xF3) // REP
{
continue;
}
#ifdef CONFIG_KALLSYMS
if ((symbol_size = sprint_symbol(symbol_buffer, jmp_address)) > 0)
{
pr_cont(" \x1B[33m[%s]", symbol_buffer);
}
#endif
if (check_page_is_valid_get_frame_number(jmp_address) != -1)
{
level_address[level] = *((unsigned long *) &jmp_address);
goto follow_jump;
}
else
{
pr_info("%s --------: %s", prefix, "\x1B[37m[The destination address of JMP instruction is in a non-mapped page. Inspection is stopped.]\n");
break;
}
}
else
{
if (level)
{
pr_info("%s --------: %s", prefix, "\x1B[37m[Unable to resolve the destination address of JMP instruction. Return to the caller function.]\n");
level_address[level--] = 0UL;
goto level_switch;
}
else
{
pr_info("%s --------: %s", prefix, "\x1B[37m[Unable to resolve the destination address of JMP instruction. Inspection is stopped.]\n");
break;
}
}
}
else if (byte[b] == 0x9A || byte[b] == 0xE8) // CALL
{
long call_address = resolve_call_address(&byte[b], count);
if (call_address)
{
#ifdef CONFIG_KALLSYMS
if ((symbol_size = sprint_symbol(symbol_buffer, call_address)) > 0)
{
pr_cont(" \x1B[33m[%s]", symbol_buffer);
}
#endif
if (check_page_is_valid_get_frame_number(call_address) != -1)
{
if (level < MAX_LEVEL)
{
level_address[level++] = (unsigned long) &byte[b + count];
level_address[level] = *((unsigned long *) &call_address);
goto level_switch;
}
pr_info("%s --------: %s", prefix, "\x1B[37m[The destination address of CALL instruction is beyond the maximum level. Not expended.]");
}
else
{
pr_info("%s --------: %s", prefix, "\x1B[37m[The destination address of CALL instruction is in a non-mapped page. Not expanded.]");
}
}
else
{
pr_info("%s --------: %s", prefix, "\x1B[37m[Unable to resolve the destination address of CALL instruction. Not expanded.]");
}
}
}
}
}
static int collect_IDT_entry_info(void)
{
unsigned short i;
gate_desc *gate_ptr;
struct desc_ptr idtr;
idt_entries = NULL;
store_idt(&idtr);
if (idtr.address)
{
if ((idt_entries = (entry_info *) kcalloc(NR_VECTORS, sizeof(entry_info), GFP_KERNEL)) != NULL)
{
for (i=0; i<NR_VECTORS; i++)
{
gate_ptr = (gate_desc *) (idtr.address + (i * sizeof(gate_desc)));
idt_entries[i].name = (idt_entry_names[i]) ? (char *) idt_entry_names[i] : NULL;
idt_entries[i].index = i;
idt_entries[i].address = (((unsigned long) gate_ptr->offset_low) |
((unsigned long) gate_ptr->offset_middle << 16) |
((unsigned long) gate_ptr->offset_high << 32));
}
return 0;
}
pr_err("[Interrupt Handler Binary Inspection] : Cannot allocate space to maintain information from IDT entries\n");
}
else
{
pr_err("[Interrupt Handler Binary Inspection] : Cannot access the \"idtr\" register in order to diplace within the IDT table\n");
}
return -1;
}
static void clean_IDT_entry_info(void)
{
if (idt_entries)
kfree((const void *) idt_entries);
}
#endif
static __init int kernel_inspection_init(void)
{
pr_info("[Interrupt Handler Binary Inspection] : Initialization\n");
#ifdef CONFIG_X86_64
if (collect_IDT_entry_info())
{
pr_err("[Interrupt Handler Binary Inspection] : Cannot proceed with a binary inspection\n");
return -1;
}
# if defined IDT_INDEX && IDT_INDEX >= 0 && IDT_INDEX < 256
binary_inspection(&idt_entries[IDT_INDEX]);
# else
binary_inspection(&idt_entries[SPURIOUS_APIC_VECTOR]);
# endif
#else
pr_err("[Interrupt Handler Binary Inspection] : Works only on x86_64 architectures\n");
#endif
return 0;
}
static __exit void kernel_inspection_exit(void)
{
#ifdef CONFIG_X86_64
clean_IDT_entry_info();
#endif
pr_info("[Interrupt Handler Binary Inspection] : Finalization\n");
}
module_init(kernel_inspection_init);
module_exit(kernel_inspection_exit);
MODULE_LICENSE("GPL");
MODULE_AUTHOR("Emiliano Silvestri <silvestri@diag.uniroma1.it>");
MODULE_DESCRIPTION("Binary Inspection of Linux Interrupt Handlers on x86_64 Architectures");