From d7c4536c91ddd307fc9b99984ac49b5b5459b485 Mon Sep 17 00:00:00 2001 From: Camil Staps Date: Mon, 30 Nov 2015 22:08:58 +0100 Subject: Assignment 2, 3 --- CamilStaps-s4498062-Assignment-2/ex2/ex2.txt | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) create mode 100644 CamilStaps-s4498062-Assignment-2/ex2/ex2.txt (limited to 'CamilStaps-s4498062-Assignment-2/ex2/ex2.txt') diff --git a/CamilStaps-s4498062-Assignment-2/ex2/ex2.txt b/CamilStaps-s4498062-Assignment-2/ex2/ex2.txt new file mode 100644 index 0000000..35afd58 --- /dev/null +++ b/CamilStaps-s4498062-Assignment-2/ex2/ex2.txt @@ -0,0 +1,20 @@ +a + According to https://en.wikipedia.org/wiki/Control_register#CR4, the SMAP and SMEP bits are used to protect ring 0. + If writing to CR4 would be allowed, we could disable this protection, and access kernel space data (e.g.) + +b + 0x40050e mov %cr4,%rax + + This attempts to move the RAX register to the CR4 register, i.e. to write to CR4. + +c + Done. I suppose it isn't necessary to give you the code or results, as all was needed was copying from the given website. + +d + See hello-cr4.c and Makefile. + + # make + [..] + # insmod hello-cr4.ko + [15892.352286] Hello world! CR4 = 7f0 + -- cgit v1.2.3