{"id":341,"date":"2020-04-28T02:53:48","date_gmt":"2020-04-28T02:53:48","guid":{"rendered":"http:\/\/malwrforensics.com\/en\/?p=341"},"modified":"2020-04-28T02:54:14","modified_gmt":"2020-04-28T02:54:14","slug":"patch-linux-kernel5-to-subvert-memory-protections","status":"publish","type":"post","link":"https:\/\/malwrforensics.com\/en\/2020\/04\/28\/patch-linux-kernel5-to-subvert-memory-protections\/","title":{"rendered":"Patch Linux kernel version 5+ to subvert memory protections"},"content":{"rendered":"\n<p>If you&#8217;re interested in removing some of the memory protections (especially around RWX) in the Linux kernel version 5+, here are some pointers:<\/p>\n\n\n\n<p>In the <em>arch<\/em> folder, edit the <em>Kconfig<\/em> file, and look for config <strong>STRICT_KERNEL_RWX<\/strong> and config <strong>STRICT_MODULE_RWX<\/strong>. You can change their default value to the values below.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"424\" height=\"67\" src=\"http:\/\/malwrforensics.com\/en\/wp-content\/uploads\/2020\/04\/kconfig_strict_kernel_rwx.png\" alt=\"\" class=\"wp-image-342\" srcset=\"https:\/\/malwrforensics.com\/en\/wp-content\/uploads\/2020\/04\/kconfig_strict_kernel_rwx.png 424w, https:\/\/malwrforensics.com\/en\/wp-content\/uploads\/2020\/04\/kconfig_strict_kernel_rwx-300x47.png 300w\" sizes=\"auto, (max-width: 424px) 100vw, 424px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"http:\/\/malwrforensics.com\/en\/wp-content\/uploads\/2020\/04\/kconfig_strict_module_rwx.png\" alt=\"\" class=\"wp-image-343\" width=\"423\" height=\"77\" srcset=\"https:\/\/malwrforensics.com\/en\/wp-content\/uploads\/2020\/04\/kconfig_strict_module_rwx.png 367w, https:\/\/malwrforensics.com\/en\/wp-content\/uploads\/2020\/04\/kconfig_strict_module_rwx-300x55.png 300w\" sizes=\"auto, (max-width: 423px) 100vw, 423px\" \/><\/figure>\n\n\n\n<p>In the <em>init<\/em> folder, edit the <em>main.c<\/em> file and search for the line containing <\/p>\n\n\n\n<p><strong>#if defined(CONFIG_STRICT_KERNEL_RWX) || defined(CONFIG_STRICT_MODULE_RWX)<\/strong><\/p>\n\n\n\n<p>One option would be to undefine both of them:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"594\" height=\"52\" src=\"http:\/\/malwrforensics.com\/en\/wp-content\/uploads\/2020\/04\/undefine_strict_kernel_module_rwx.png\" alt=\"\" class=\"wp-image-344\" srcset=\"https:\/\/malwrforensics.com\/en\/wp-content\/uploads\/2020\/04\/undefine_strict_kernel_module_rwx.png 594w, https:\/\/malwrforensics.com\/en\/wp-content\/uploads\/2020\/04\/undefine_strict_kernel_module_rwx-300x26.png 300w\" sizes=\"auto, (max-width: 594px) 100vw, 594px\" \/><\/figure>\n\n\n\n<p>Another option is to search for the <strong>mark_readonly(void)<\/strong> function, and remove most of its contents:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"607\" height=\"242\" src=\"http:\/\/malwrforensics.com\/en\/wp-content\/uploads\/2020\/04\/mark_readonly_fn.png\" alt=\"\" class=\"wp-image-345\" srcset=\"https:\/\/malwrforensics.com\/en\/wp-content\/uploads\/2020\/04\/mark_readonly_fn.png 607w, https:\/\/malwrforensics.com\/en\/wp-content\/uploads\/2020\/04\/mark_readonly_fn-300x120.png 300w\" sizes=\"auto, (max-width: 607px) 100vw, 607px\" \/><\/figure>\n\n\n\n<p>Afterwards, you can <a href=\"http:\/\/malwrforensics.com\/en\/2020\/04\/27\/enable-cr0-write-in-linux-kernel-5\/\">compile<\/a> the kernel and enjoy modifying structures that were once read-only.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>If you&#8217;re interested in removing some of the memory protections (especially around RWX) in the Linux kernel version 5+, here are some pointers: In the arch folder, edit the Kconfig file, and look for config STRICT_KERNEL_RWX and config STRICT_MODULE_RWX. You can change their default value to the values below. In the init folder, edit the [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[53,1],"tags":[34,11,117,124,126],"class_list":["post-341","post","type-post","status-publish","format-standard","hentry","category-linux","category-security","tag-kernel","tag-linux","tag-linux-kernel","tag-memory-protection","tag-rwx"],"blocksy_meta":{"styles_descriptor":{"styles":{"desktop":"","tablet":"","mobile":""},"google_fonts":[]}},"featured_image_urls_v2":{"full":"","thumbnail":"","medium":"","medium_large":"","large":"","1536x1536":"","2048x2048":""},"post_excerpt_stackable_v2":"<p>If you&#8217;re interested in removing some of the memory protections (especially around RWX) in the Linux kernel version 5+, here are some pointers: In the arch folder, edit the Kconfig file, and look for config STRICT_KERNEL_RWX and config STRICT_MODULE_RWX. You can change their default value to the values below. In the init folder, edit the main.c file and search for the line containing #if defined(CONFIG_STRICT_KERNEL_RWX) || defined(CONFIG_STRICT_MODULE_RWX) One option would be to undefine both of them: Another option is to search for the mark_readonly(void) function, and remove most of its contents: Afterwards, you can compile the kernel and enjoy modifying&hellip;<\/p>\n","category_list_v2":"<a href=\"https:\/\/malwrforensics.com\/en\/category\/linux\/\" rel=\"category tag\">Linux+<\/a>, <a href=\"https:\/\/malwrforensics.com\/en\/category\/security\/\" rel=\"category tag\">Security<\/a>","author_info_v2":{"name":"malwrforensics","url":"https:\/\/malwrforensics.com\/en\/author\/u_malwrforensics\/"},"comments_num_v2":"0 comments","_links":{"self":[{"href":"https:\/\/malwrforensics.com\/en\/wp-json\/wp\/v2\/posts\/341","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/malwrforensics.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/malwrforensics.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/malwrforensics.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/malwrforensics.com\/en\/wp-json\/wp\/v2\/comments?post=341"}],"version-history":[{"count":2,"href":"https:\/\/malwrforensics.com\/en\/wp-json\/wp\/v2\/posts\/341\/revisions"}],"predecessor-version":[{"id":347,"href":"https:\/\/malwrforensics.com\/en\/wp-json\/wp\/v2\/posts\/341\/revisions\/347"}],"wp:attachment":[{"href":"https:\/\/malwrforensics.com\/en\/wp-json\/wp\/v2\/media?parent=341"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/malwrforensics.com\/en\/wp-json\/wp\/v2\/categories?post=341"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/malwrforensics.com\/en\/wp-json\/wp\/v2\/tags?post=341"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}