linux-kernel - RE: vfat: Broken case-insensitive support for UTF-8

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <2f8f667b149d4a3e97a924ecbb102875@AcuMS.aculab.com>
Date:   Tue, 21 Jan 2020 12:43:53 +0000
From:   David Laight <David.Laight@...LAB.COM>
To:     'Pali Rohár' <pali.rohar@...il.com>,
        Al Viro <viro@...iv.linux.org.uk>
CC:     OGAWA Hirofumi <hirofumi@...l.parknet.co.jp>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "linux-fsdevel@...r.kernel.org" <linux-fsdevel@...r.kernel.org>,
        "Theodore Y. Ts'o" <tytso@....edu>,
        Namjae Jeon <linkinjeon@...il.com>,
        "Gabriel Krisman Bertazi" <krisman@...labora.com>
Subject: RE: vfat: Broken case-insensitive support for UTF-8

From: Pali Rohár
> Sent: 20 January 2020 23:58
...
> It is OK, but too complicated. That function is in nt kernel. So you
> need to build a new kernel module and also decide where to put output of
> that function. It is a long time since I did some nt kernel hacking and
> nowadays you need to download 10GB+ of Visual Studio code, then addons
> for building kernel modules, figure out how to write and compile simple
> kernel module via Visual Studio, write ini install file, try to load it
> and then you even fail as recent Windows kernels refuse to load kernel
> modules which are not signed...

Actually it isn't quite that hard.
You can download Windbg.exe (without too much other junk if you find the right place).
Use bcdedit to let it look at the current kernel (and reboot).
Then you can grovel through the live system kernel with almost no restriction.
Point it at the 'symbol server' and it knows the layouts of a lot of kernel structures.
OTOH it's command syntax is spectacularly horrid.

There is also a boot flag to let you load 'test signed' drivers.
OTOH signing drivers for a release is now a real PITA.

	David

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)