Mobile Hacking using Linux Drivers

Mobile Hacking
through
Linux Drivers

© 2012 Anil Kumar Pugalia <email@sarika-pugs.com>
All Rights Reserved.

What to Expect?
Objective
Usual Linux Kernel Hacking Techniques
Tools to do Reverse-engineering
Assumptions
Linux Kernel is already ported onto a Mobile
Getting into the mobile has been figured out

© 2012 Anil Kumar Pugalia <email@sarika-pugs.com> 2

The Hacking Architecture
User Space
(provides interface for hacking)

Kernel Space
(provides functionalities & facilities to hack)

Hardware
(is what needs Hacking)

System Call I/F
(the connector)


Kernel Space Functionality
Process Management
Memory Management
Device Management
Storage Management
Network Management


Kernel Driver Ecosystem
bash gvim X Server ssh gcc firefox

Process Memory Device
File Systems Networking
Management Management Control

Concurrency Virtual Ttys & Files & Dirs: Connectivity
MultiTasking Memory Device Access The VFS
Architecture Character Filesystem Network
Memory
Dependent Drivers Layer Subsystem
Manager
Code & Block Layer Interface
Friends & Drivers Drivers
Hardware Protocol Layers like PCI, USB, I2C, RS232, ...

Consoles, Disks & Network
CPU Memory `
etc CDs Interfaces


Kernel Source Organization
/usr/src/linux/

arch/<arch>
mm
drivers

fs char mtd/ide net pci serial usb ...
block
net
include
linux asm-<arch>

init kernel ipc lib scripts tools

crypto firmware security sound ...


Show me the Source Code


Kernel Build System
Key components
Makefile
Kconfig
Configuring the Makefile
Setting up the kernel version (specially for the
Desktops)
For Cross Compilation, need to setup
ARCH
CROSS_COMPILE
Or, invoke make with these options

Kernel Configuration
make config
make menuconfig
make xconfig
Others
make defconfig
make oldconfig
make <specific>config


Kernel Compilation
After configuring the kernel, we are all set to build it
Build Methods
make vmlinux – To build everything configured for a kernel image
make modules – To build only configured modules
make – To build everything configured (kernel image & modules)
make modules_prepare – To only prepare for building modules
Cleaning Methods
make clean – Simple clean
make mrproper – Complete sweep clean, incl. Configs


Linux Kernel Images
Kernel Image should be understood by Stage 2 Bootloader
Default kernel compilation builds vmlinux
vmlinux is understood only by the desktop bootloaders
So, for embedded systems, we would typically have to do the
following
Creating linux.bin using <cross>-objcopy
Example: arm-linux-objcopy -O binary vmlinux linux.bin
And then, convert it into the bootloader specific image using some
bootloader utility. For u-boot, it is done using mkimage
Example: mkimage -A arm -O linux -T kernel -C none -a 20008000 -e 20008000
-n “Custom” -d linux.bin uImage.arm


Powerful Kernel Arguments
console – Boot up & access interface
root – Base file system contents
mem – Limit the RAM usage
nfsroot – Base file system over nfs
ip – IP address on boot
...


Do we really need to build the kernel?

Not really.
Alternative: Use Modules instead.


W's of a Module?
Hot plug-n-play Driver
Dynamically Loadable & Unloadable
Linux – the first OS to have such a feature
Later many followed suit
Enables fast hacking cycle
File: <module>.ko (Kernel Object)
<module>.o wrapped with kernel signature


Module Commands
lsmod – List modules
insmod <mod_file> – Load module
rmmod <module> – Unload module
modprobe <module> – Auto load module


The Module Constructor
static int __init mfd_init(void)
{

...

return 0;
}
module_init(mfd_init);

The Module Destructor
static void __exit mfd_exit(void)
{

...

}
module_exit(mfd_exit);


Typical Makefile
ifeq (${KERNELRELEASE},)

KERNEL_SOURCE := <kernel source directory path>

PWD := $(shell pwd)

default:

$(MAKE) -C ${KERNEL_SOURCE} SUBDIRS=$(PWD) modules

clean:

$(MAKE) -C ${KERNEL_SOURCE} SUBDIRS=$(PWD) clean

else

obj-m += <module>.o

endif


How to Hack?


printk & syslogd
Header: <linux/kernel.h>
Arguments: Same as printf
Format Specifiers: All as in printf, except float & double related
Additionally, a initial 3 character sequence for Log Level
KERN_EMERG "<0>" /* system is unusable */
KERN_ALERT "<1>" /* action must be taken immediately */
KERN_CRIT "<2>" /* critical conditions */
KERN_ERR "<3>" /* error conditions */
KERN_WARNING "<4>" /* warning conditions */
KERN_NOTICE "<5>" /* normal but significant condition */
KERN_INFO "<6>" /* informational */
KERN_DEBUG "<7>" /* debug-level messages */


Logs & Kernel Windows
Log View Commands
dmesg | tail
tail /var/log/messages
Kernel Windows
/proc
/sys
Peeping Commands
cat <window_file>
Utilities: sysfsutils, sysdiag

Cool Kernel Windows
Trivial ones
/proc/cpuinfo
/proc/meminfo
/proc/devices
/proc/filesystems
/proc/partitions
/proc/interrupts
/proc/softirqs
Hacking Experts
/proc/kallsyms
/proc/kcore
/proc/iomem
/proc/ioports
/proc/bus/*/devices
/sys/class

Kernel Probes
kprobes → CONFIG_KPROBES
jprobes → Specialized Kprobes
For probing function entry points
kretprobes → Return Kprobes
For probing function exit points


Kernel Hacking Related Options
CONFIG_PRINTK_TIME
CONFIG_DEBUG_SLAB
CONFIG_DEBUG_HIMEM, CONFIG_DEBUG_PAGE_ALLOC
CONFIG_DEBUG_SPINLOCK
CONFIG_MAGIC_SYSRQ (kdump related)
CONFIG_DETECT_SOFTLOCKUP
CONFIG_DEBUG_STACKOVERFLOW
CONFIG_DEBUG_STACK_USAGE
CONFIG_BUG
CONFIG_DEBUG_BUGVERBOSE
CONFIG_KALLSYMS (for debugging oops using gdb)
Under “General setup” → “Configure Std Kernel ... (for small systems)”

Memory & Device Access

RAM
Memory
Controller
32
32

Data Bus CPU Address Bus
32

Bus
Controller
Device
uController Address Space
32


Kernel Space Memory Access
Virtual Address on Physical Address
Header: <linux/gfp.h>
unsigned long __get_free_pages(flags, order); etc
void free_pages(addr, order); etc
Header: <linux/slab.h>
void *kmalloc(size_t size, gfp_t flags);
GFP_USER, GFP_KERNEL, GFP_DMA
void kfree(void *obj);
Header: <linux/vmalloc.h>
void *vmalloc(unsigned long size);
void vfree(void *addr);

Kernel Space Device Access
Virtual Address for Bus/IO Address
Header: <asm/io.h>
void *ioremap(phys_addr_t bus_addr, unsigned long size);
void iounmap(void *addr);
I/O Memory Access
Header: <asm/io.h>
u[8|16|32] ioread[8|16|32](void *addr);
void iowrite[8|16|32](u[8|16|32] value, void *addr);

Kernel Window: /proc/iomem


x86 Hardware Architecture

RAM
North
32 Bridge

32
32
x86 Address Bus
Data Bus
CPU
32

I/O Ports / I/O Line

Address South
Space 16 Bridge (PCI) Device
32 Address Space


I/O Access (x86* specific)
I/O Port Access
u8 inb(unsigned long port);
u16 inw(unsigned long port);
u32 inl(unsigned long port);
void outb(u8 value, unsigned long port);
void outw(u16 value, unsigned long port);
void outl(u32 value, unsigned long port);

Header: <asm/io.h>
Kernel Window: /proc/ioports


Hacking from User Space
Decoding Code
objdump -d <object_file> – Disassemble
nm <object_file> – List symbols
Tracing: strace [options] <command>
Decoding Bus Devices
PCI – lspci [-v[v]]
USB – lsusb [-v]


What all have we learnt talked?
Linux' Hacking Architecture
Configuring & Compiling the Linux Kernel
Boot Control using Kernel Boot Args
Hacking Flexibility w/ Linux Modules
Ready-made Hacking Tools & Techniques


Any Queries?


Contact Me
Mailing List
computerclubin@googlegroups.com
Website
http://www.sysplay.in
Email
email@sarika-pugs.com
Twitter
anil_pugalia
© 2012 Anil Kumar Pugalia <email@sarika-pugs.com>

Mobile Hacking using Linux Drivers

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Viewers also liked

Viewers also liked (13)

Similar to Mobile Hacking using Linux Drivers

Similar to Mobile Hacking using Linux Drivers (20)

More from Anil Kumar Pugalia

More from Anil Kumar Pugalia (11)

Recently uploaded

Recently uploaded (20)

Mobile Hacking using Linux Drivers