linux-kernel - Re: Does this work? "dcprobes" an x86-hack simple djprobes-equivalent?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <451B33C8.4080107@hitachi.com>
Date:	Thu, 28 Sep 2006 11:30:32 +0900
From:	Masami Hiramatsu <masami.hiramatsu.pt@...achi.com>
To:	karim@...rsys.com
Cc:	Richard J Moore <richardj_moore@...ibm.com>,
	Mathieu Desnoyers <mathieu.desnoyers@...ymtl.ca>,
	"Frank Ch. Eigler" <fche@...hat.com>, Ingo Molnar <mingo@...e.hu>,
	Ingo Molnar <mingo@...hat.com>,
	linux-kernel <linux-kernel@...r.kernel.org>,
	SystemTAP <systemtap@...rces.redhat.com>,
	Satoshi Oshima <soshima@...hat.com>,
	"Martin J. Bligh" <mbligh@...igh.org>,
	Prasanna S Panchamukhi <prasanna@...ibm.com>,
	Tom Zanussi <zanussi@...ibm.com>,
	Michel Dagenais <michel.dagenais@...ymtl.ca>,
	William Cohen <wcohen@...hat.com>,
	Alan Cox <alan@...rguk.ukuu.org.uk>,
	Andrew Morton <akpm@...l.org>,
	Christoph Hellwig <hch@...radead.org>
Subject: Re: Does this work? "dcprobes" an x86-hack simple djprobes-equivalent?

Hi Karim,

Thank you for new idea.
I discussed your proposal deeply with my coworkers.

I think your approach has following advantages/disadvantages/problem;
<advantages>
(a) Able to be inserted into the target address of the branch.
(b) So, binary analysis tool becomes simple.
<disadvantages>
(c) Implementation is much complicated.
(d) Highly depend on the x86 arch.
(e) Bigger overhead than djprobe.
(f) There will be side effect(*)
<problem>
(g) User applications can modify LDT. (ex. wine)

I think the dcprobe will work, but, unfortunately, it has
an vulnerability by the problem (g).

(*) In the following code:
---
a=0
do {
...
a++;
}while (a <= 100)
---
In case of inserting dcprobe at the 1st line (a=0),
it will replace 2nd (or more) instructions.
In this case, the fix up routine (based on int3)
will be invoked one hundred times.

Thanks,



-- 
Masami HIRAMATSU
2nd Research Dept.
Hitachi, Ltd., Systems Development Laboratory
E-mail: masami.hiramatsu.pt@...achi.com


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/