full-disclosure - Small Linux Kernel Patch To Check For Shdr

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20050917010440.86021.qmail@web35706.mail.mud.yahoo.com>
Date: Sat Sep 17 16:52:05 2005
From: justliketocode at yahoo.com (none none)
Subject: Small Linux Kernel Patch To Check For Shdr

This small patch can be applied to the Linux kernel
2.6.13 sources. It just checks if an ELF binary has a
section header or not. Only tested on i386 and always
only for fun. A pretty basic technique to throw off
debugging and disassembler tools is to strip the
section header off of an ELF executable. Archaic tools
like objdump will fail when told to open a binary
whose section header is gone. So now your kernel won't
even execute such binaries. Be warned some distros may
strip out their section headers to save space, its not
necesary for execution. The patch is basic, nothing
cool. And comes with no guarntee :)

--- a/fs/binfmt_elf.c   2005-08-28 19:41:01.000000000
-0400
+++ b/fs/binfmt_elf.c   2005-09-16 21:02:16.000000000
-0400
@@ -560,6 +560,11 @@ static int load_elf_binary(struct
linux_

        if (loc->elf_ex.e_phentsize != sizeof(struct
elf_phdr))
                goto out;
+       /* two simple checks to quit if binary has no
shdr */
+       if (loc->elf_ex.e_shentsize == 0)
+               goto out;
+       if (loc->elf_ex.e_shnum == 0)
+               goto out;
        if (loc->elf_ex.e_phnum < 1 ||
                loc->elf_ex.e_phnum > 65536U /
sizeof(struct elf_phdr))
                goto out;

__________________________________ 
Yahoo! Mail - PC Magazine Editors' Choice 2005 
http://mail.yahoo.com