Tag kernel

Linux+, Security

Patch Linux kernel version 5+ to subvert memory protections

If you’re interested in removing some of the memory protections (especially around RWX) in the Linux kernel version 5+, here are some pointers: In the arch folder, edit the Kconfig file, and look for config STRICT_KERNEL_RWX and config STRICT_MODULE_RWX. You…

malwrforensics
April 28, 2020

Security

(Kernel) debugging with windbg

Set the Windows VM for debugging: bcdedit /debug on bcdedit /dbgsettings serial debugport:1 baudrate:115200 In the VM settings, associate a pipe to the COM1 port: \\.\\pipe\debugk (windows) or /tmp/debugk (linux) Here is a list of…

malwrforensics
January 21, 2018