Comments (8)
@milabs I firstly thought this was based on processes blocking the release, but it seems that's not 100% true. For example, if I turn on procmon (state=1) and then I open ksysguard (KDE's task manager) and then I close it, I still can't unload procmon until I open ksysguard once again.
Why could that be?
from monks.
Well, it's the result of the hooking technique. Let's look at how it's happend:
sys_call_table[__NR_read]
-> hooked_sys_read
-> sys_read_pre_hook_action
-> ret = real_sys_read (can take a long time...)
-> sys_read_post_hook_action
So, the problem is that when we unloading the module while real_sys_read
is in kernel we get fault when it returns as there no module code in kernel. Now, we implement some logic so we'are looking for counters which tells us if there is a hook that is in kernel while unloading. OK, got it.
But the next problem is that we don't know exactly how to do with such processes that sleeps near infinite time in the kernel. We can wait a lot and unload the module, but it leads to accidental crashes. Not the best case :)
As I see it the possible solution is to create stubs
like that:
sys_read_stub:
call sys_read_pre_hook_action
call real_sys_read
call sys_read_post_hook_action
RET
Now, when we need to unload the module, we modify such stubs to looks like that:
sys_read_stub:
nop nop nop nop nop
call real_sys_read
nop nop nop nop nop
RET
Now, we unloading but don't touch these stubs. I meant that we don't free allocated area (which has exec permissions).
The one problem here is that we eat some kernel's memory per load/unload
cycle. But I can't see any other method to allow safely unloading the module.
What do you think?
from monks.
@milabs But that will happen if we alloc N bytes of memory for that stub and then unload the module (not state=0 but rmmod procmon)? Won't that stub memory just disappear (thus causing a crash in the sleeping processes)?
from monks.
@alexandernst As the stub resides in memory after unloading nothing bad happens when the real_sys_read
returns, for ex.
from monks.
@milabs Can you do a simple POC, please?
from monks.
@alexandernst Not now... Create and assign an issue please?
from monks.
@milabs Sure ;)
from monks.
Closing this as I just implemented #31. This is not needed anymore.
from monks.
Related Issues (20)
- Stop sending empty messages to kernel module
- Maybe we're missing messages HOT 8
- Up/down keys are buggy
- Logging to file
- Use kernel thread to handle all the netlink messages HOT 5
- Use stub funcitons for the un/hook process HOT 39
- Procmon-viewer crashes while resizing HOT 2
- Multi-viewer support HOT 1
- Rename procmon to avoid conflicts with MS HOT 10
- Check if syscall table is faked HOT 15
- rmmod procmon.ko BUG? HOT 2
- Anti-rootkit
- Clear 32/86/64 mess HOT 2
- Data get's invalidated HOT 4
- Calculate how many syscalls are faked HOT 13
- Academic project
- Create wiki
- Wrong comments
- I have a question when I run make inside the root folder,'start_color' has not defined,but I already install the curse.h library,why? HOT 9
- Inserting of kernel module fails
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from monks.