{"id":331,"date":"2020-04-27T04:43:04","date_gmt":"2020-04-27T04:43:04","guid":{"rendered":"http:\/\/malwrforensics.com\/en\/?p=331"},"modified":"2020-05-18T00:04:19","modified_gmt":"2020-05-18T00:04:19","slug":"enable-cr0-write-in-linux-kernel-5","status":"publish","type":"post","link":"https:\/\/malwrforensics.com\/en\/2020\/04\/27\/enable-cr0-write-in-linux-kernel-5\/","title":{"rendered":"Enable CR0 write in Linux kernel 5+"},"content":{"rendered":"\n<p>If you ever want to disable the WriteProtect (WP) bit you&#8217;ll need to read\/write access to the CR0 register. The problem is that the write_cr0 function provided by the linux kernel has been tweaked to prevent this exact thing.<\/p>\n\n\n\n<p>Here are the steps you need to follow to compile a new kernel and have the changed removed:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Go to <a href=\"https:\/\/www.kernel.org\/\">https:\/\/www.kernel.org\/<\/a> and download the latest stable version.<\/li><li>$ unxz -v linux-&lt;version&gt;.tar.xz<\/li><li>$ tar xvf linux-&lt;version&gt;.tar<\/li><li>$ cd linux-&lt;version&gt;<\/li><li>$ cp -v \/boot\/config-$(uname -r) .config<\/li><li>Ubuntu: $ sudo apt-get build-dep linux linux-image-$(uname -r) &amp;&amp; apt-get install build-essential libncurses-dev flex bison openssl libssl-dev dkms libelf-dev libudev-dev libpci-dev libiberty-dev autoconf<\/li><li>CentOS: $ sudo yum groupinstall &#8220;Development Tools&#8221; &amp;&amp; yum install ncurses-devel openssl-devel hmaccalc zlib-devel binutils-devel elfutils-libelf-devel<\/li><li>Patch the <em>native_write_cr0<\/em> function (in arch\/x86\/kernel\/cpu\/common.c). Basically, remove everything related to <em>cr_pinning<\/em>, <em>X86_CR0_WP<\/em>, and leave only the <strong>asm volatile(&#8220;mov %0, %%cr0&#8221;: &#8220;+r&#8221; (val), &#8220;+m&#8221; (__force_order))<\/strong> line.<\/li><\/ul>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"756\" height=\"442\" src=\"http:\/\/malwrforensics.com\/en\/wp-content\/uploads\/2020\/04\/patch_native_write_cr0.png\" alt=\"\" class=\"wp-image-332\" srcset=\"https:\/\/malwrforensics.com\/en\/wp-content\/uploads\/2020\/04\/patch_native_write_cr0.png 756w, https:\/\/malwrforensics.com\/en\/wp-content\/uploads\/2020\/04\/patch_native_write_cr0-300x175.png 300w\" sizes=\"auto, (max-width: 756px) 100vw, 756px\" \/><\/figure>\n\n\n\n<ul class=\"wp-block-list\"><li>$ make menuconfig<\/li><li>$ make -j$(nproc)<\/li><li>$ make modules<\/li><li>$ sudo make modules_install<\/li><li>$ sudo make install<\/li><\/ul>\n\n\n\n<p>Happy hooking syscalls \ud83d\ude42<\/p>\n\n\n\n<p>Hint: <em>cat \/proc\/kallsyms | grep sys_call_table<\/em> has the address you&#8217;re looking for.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>If you ever want to disable the WriteProtect (WP) bit you&#8217;ll need to read\/write access to the CR0 register. The problem is that the write_cr0 function provided by the linux kernel has been tweaked to prevent this exact thing. Here are the steps you need to follow to compile a new kernel and have the [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[53,1],"tags":[127,118,121,114,123,120,15,115,116,119,122],"class_list":["post-331","post","type-post","status-publish","format-standard","hentry","category-linux","category-security","tag-centos","tag-compile-linux-kernel","tag-cr-pinning","tag-cr0-register","tag-kallsyms","tag-sys_call_table","tag-ubuntu","tag-wp-bit","tag-write-protect","tag-write_cr0","tag-x86_cr0_wp"],"blocksy_meta":{"styles_descriptor":{"styles":{"desktop":"","tablet":"","mobile":""},"google_fonts":[]}},"featured_image_urls_v2":{"full":"","thumbnail":"","medium":"","medium_large":"","large":"","1536x1536":"","2048x2048":""},"post_excerpt_stackable_v2":"<p>If you ever want to disable the WriteProtect (WP) bit you&#8217;ll need to read\/write access to the CR0 register. The problem is that the write_cr0 function provided by the linux kernel has been tweaked to prevent this exact thing. Here are the steps you need to follow to compile a new kernel and have the changed removed: Go to https:\/\/www.kernel.org\/ and download the latest stable version.$ unxz -v linux-&lt;version&gt;.tar.xz$ tar xvf linux-&lt;version&gt;.tar$ cd linux-&lt;version&gt;$ cp -v \/boot\/config-$(uname -r) .configUbuntu: $ sudo apt-get build-dep linux linux-image-$(uname -r) &amp;&amp; apt-get install build-essential libncurses-dev flex bison openssl libssl-dev dkms libelf-dev libudev-dev libpci-dev libiberty-dev&hellip;<\/p>\n","category_list_v2":"<a href=\"https:\/\/malwrforensics.com\/en\/category\/linux\/\" rel=\"category tag\">Linux+<\/a>, <a href=\"https:\/\/malwrforensics.com\/en\/category\/security\/\" rel=\"category tag\">Security<\/a>","author_info_v2":{"name":"malwrforensics","url":"https:\/\/malwrforensics.com\/en\/author\/u_malwrforensics\/"},"comments_num_v2":"0 comments","_links":{"self":[{"href":"https:\/\/malwrforensics.com\/en\/wp-json\/wp\/v2\/posts\/331","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/malwrforensics.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/malwrforensics.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/malwrforensics.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/malwrforensics.com\/en\/wp-json\/wp\/v2\/comments?post=331"}],"version-history":[{"count":13,"href":"https:\/\/malwrforensics.com\/en\/wp-json\/wp\/v2\/posts\/331\/revisions"}],"predecessor-version":[{"id":353,"href":"https:\/\/malwrforensics.com\/en\/wp-json\/wp\/v2\/posts\/331\/revisions\/353"}],"wp:attachment":[{"href":"https:\/\/malwrforensics.com\/en\/wp-json\/wp\/v2\/media?parent=331"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/malwrforensics.com\/en\/wp-json\/wp\/v2\/categories?post=331"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/malwrforensics.com\/en\/wp-json\/wp\/v2\/tags?post=331"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}