linux-kernel - Re: 2.6.23-rc1: no setup signature found...

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20070729191528.GA5166@gollum.tnic>
Date:	Sun, 29 Jul 2007 21:15:28 +0200
From:	Borislav Petkov <bbpetkov@...oo.de>
To:	"H. Peter Anvin" <hpa@...or.com>
Cc:	Xudong Guan <xudong.guan@...il.com>, linux-kernel@...r.kernel.org,
	Chuck Ebbert <cebbert@...hat.com>
Subject: Re: 2.6.23-rc1: no setup signature found...

On Sun, Jul 29, 2007 at 06:50:32AM -0700, H. Peter Anvin wrote:
> Borislav Petkov wrote:
>> Right, this was too easy to be true. I now did:
>> qemu -hda /dev/hda -snapshot
>> and booted from the hd using the installed grub and the same kernel and it
>> _didn't_ boot showing again "no setup signature found... "
>
> Okay, so it's an algorithmic problem.  This is quite important to know.
>
> Is /boot a separate partition on your disk by any chance?  Either way, this 
> means we can use qemu to debug this, which will make it a lot easier.
>
> This is what I'd like you to do next:
>
> - run qemu in one window with the -S -s options.
> - in another window, do:
>
> 	gdb
> 	target remote localhost:1234
> 	set architecture i8086
> 	disp/i ($cs << 4)+$eip
> 	br *0x10200
> 	br *0x20200
> 	br *0x30200
> 	br *0x40200
> 	br *0x50200
> 	br *0x60200
> 	br *0x70200
> 	br *0x80200
> 	br *0x90200
> 	c
>
> 	# ... hopefully you're now stopped at a jump instruction
> 	p/x $ds
> 	
> 	# Hopefully this is showing, say, 0x9000 if you're stopped
> 	# at 0x90200
>
> 	# Where X is the first digit of the address stopped at:
> 	dump memory setup.dump 0xX0000 0xX8000
>
>
> Please send me setup.dump plus your vmlinuz file.
>
> Thanks,
>
> 	-hpa

Here's a complete log of what i did:

qemu -hda /dev/hda -snapshot -S -s

and then in another window:

-------
[]# gdb
GNU gdb 6.6-debian
Copyright (C) 2006 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i486-linux-gnu".
(gdb) target remote localhost:1234
Remote debugging using localhost:1234
0x0000fff0 in ?? ()
(gdb) set architecture i8086
The target architecture is assumed to be i8086
(gdb) disp/i ($cs << 4)+$eip
1: x/i ($cs << 4) + $eip  0xffff0:      ljmp   $0xf000,$0xe05b
(gdb) br *0x10200
Breakpoint 1 at 0x10200
(gdb) br *0x20200
Breakpoint 2 at 0x20200
(gdb) br *0x30200
Breakpoint 3 at 0x30200
(gdb) br *0x40200
Breakpoint 4 at 0x40200
(gdb) br *0x50200
Breakpoint 5 at 0x50200
(gdb) br *0x60200
Breakpoint 6 at 0x60200
(gdb) br *0x70200
Breakpoint 7 at 0x70200
(gdb) br *0x80200
Breakpoint 8 at 0x80200
(gdb) br *0x90200
Breakpoint 9 at 0x90200
(gdb) c
Continuing.

Breakpoint 4, 0x00040200 in ?? ()
1: x/i ($cs << 4) + $eip  0x40300:      lea    (%si),%dx
(gdb) p/x $ds
$1 = 0x18
(gdb) dump memory setup.dump 0x40000 0x48000
(gdb) q
The program is running.  Exit anyway? (y or n) y
---EOF---

Please find the setup.dump file attached. And by vmlinuz you meant bzImage,
right? Anyways, due to the fact that its size will not fit in vger's size limits
i'm sending it to you in a private mail.

-- 
Regards/Gruß,
    Boris.

Download attachment "setup.dump" of type "application/octet-stream" (32768 bytes)