linux-kernel - Re: 2.6.23-rc1: no setup signature found...

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20070801043835.GA4676@gollum.tnic>
Date:	Wed, 1 Aug 2007 06:38:36 +0200
From:	Borislav Petkov <bbpetkov@...oo.de>
To:	"H. Peter Anvin" <hpa@...or.com>
Cc:	Xudong Guan <xudong.guan@...il.com>, linux-kernel@...r.kernel.org,
	Chuck Ebbert <cebbert@...hat.com>
Subject: Re: 2.6.23-rc1: no setup signature found...

On Mon, Jul 30, 2007 at 01:46:33PM -0700, H. Peter Anvin wrote:
> Borislav Petkov wrote:
>> Hi,
>> i decided to do some cheating :) and skipped the breakpoint where it used 
>> to
>> stop (0x40200). (by the way, hitting 'c' wouldn't continue at all and keep
>> executing the same instruction over and over again). This time it seems it 
>> behaves as expected:
>
> Uhm, it looks to me that you ran qemu with the -kernel option again (I can 
> tell because the dump exhibits a few bugs that are characteristic of the 
> qemu loader.)  This makes qemu itself load the kernel and not rely on the 
> boot loader that's on your bootloader.
>
> I was expecting you to run "qemu -S -s -hda /dev/hda -snapshot", which you 
> previously said when run (without the -S -s) options reproduced the 
> problem.
ups, sorry for that, i thought falsely here that you want to debug the kernel
part of the setup code ...
>
> After taking the dump, please do:
>
> 	delete
> 	c
>
> ... to verify the problem is reproduced.

In this case, we never land on a jump instruction:

GNU gdb 6.6-debian
Copyright (C) 2006 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i486-linux-gnu".
(gdb) target remote localhost:1234
Remote debugging using localhost:1234
0x0000fff0 in ?? ()
	(gdb) set arch i8086
	The target architecture is assumed to be i8086
	(gdb) disp/i ($cs << 4)+$eip
	1: x/i ($cs << 4) + $eip  0xffff0:      ljmp   $0xf000,$0xe05b
	(gdb) br *0x10200
	Breakpoint 1 at 0x10200
	(gdb)         br *0x20200
	Breakpoint 2 at 0x20200
	(gdb)         br *0x30200
	Breakpoint 3 at 0x30200
	(gdb)         br *0x40200
	Breakpoint 4 at 0x40200
	(gdb)         br *0x50200
	Breakpoint 5 at 0x50200
	(gdb)         br *0x60200
	Breakpoint 6 at 0x60200
	(gdb)         br *0x70200
	Breakpoint 7 at 0x70200
	(gdb)         br *0x80200
	Breakpoint 8 at 0x80200
	(gdb)         br *0x90200
	Breakpoint 9 at 0x90200
	(gdb) c
	Continuing.

	Breakpoint 4, 0x00040200 in ?? ()
	1: x/i ($cs << 4) + $eip  0x40300:      lea    (%si),%dx
	(gdb) c
	Continuing.

if i do delete here, it loads the second stage of grub and continues to load the
kernel. Is there another way to land at the jmp instruction instead of poking
blindly, maybe disassemble something parts of the initial code. \me reading
grub-docs...

-- 
Regards/Gruß,
    Boris.
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/