forked from bcoles/kasld
-
Notifications
You must be signed in to change notification settings - Fork 0
/
dmesg_kaslr-disabled.c
110 lines (91 loc) · 2.6 KB
/
dmesg_kaslr-disabled.c
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
// This file is part of KASLD - https://github.com/bcoles/kasld
//
// Search kernel log for messages stating KASLR is disabled.
//
// ARM64:
// KASLR disabled due to lack of seed
// KASLR disabled due to FDT remapping failure
//
// S390:
// KASLR disabled: CPU has no PRNG
// KASLR disabled: not enough memory
//
// Introduced for ARM64 in kernel v5.5-rc1~22^2~11^9~1 on 2019-11-09:
// https://github.com/torvalds/linux/commit/294a9ddde6cdbf931a28b8c8c928d3f799b61cb5
//
// Requires:
// - kernel.dmesg_restrict = 0; or CAP_SYSLOG capabilities; or
// readable /var/log/dmesg.
//
// References:
// https://elixir.bootlin.com/linux/v5.19.17/source/arch/arm64/kernel/kaslr.c#L197
// https://elixir.bootlin.com/linux/v5.19.17/source/arch/arm64/kernel/kaslr.c#L200
// https://elixir.bootlin.com/linux/v6.1.6/source/arch/arm64/kernel/kaslr.c#L45
// https://elixir.bootlin.com/linux/v6.1.1/source/arch/s390/boot/kaslr.c#L35
// https://elixir.bootlin.com/linux/v6.1.1/source/arch/s390/boot/kaslr.c#L201
// ---
// <[email protected]>
#define _GNU_SOURCE
#include "include/syslog.h"
#include "kasld.h"
#include <errno.h>
#include <stdbool.h>
#include <string.h>
#include <unistd.h>
unsigned long search_dmesg_kaslr_disabled() {
int size;
char *syslog;
char *line;
const char *needle = "KASLR disabled";
bool nokaslr = false;
printf("[.] searching dmesg for '%s' ...\n", needle);
if (mmap_syslog(&syslog, &size))
return 0;
line = strtok(syslog, "\n");
while ((line = strtok(NULL, "\n")) != NULL) {
if (strstr(line, needle)) {
nokaslr = true;
printf("[.] Kernel was booted with KASLR disabled\n");
// printf("%s\n", line);
break;
}
}
if (nokaslr)
return (unsigned long)KERNEL_TEXT_DEFAULT;
return 0;
}
unsigned long search_dmesg_log_file_kaslr_disabled() {
FILE *f;
char *line;
size_t size = 0;
const char *path = "/var/log/dmesg";
const char *needle = "KASLR disabled";
bool nokaslr = false;
printf("[.] searching %s for '%s' ...\n", path, needle);
f = fopen(path, "rb");
if (f == NULL) {
perror("[-] fopen");
return 0;
}
while ((getline(&line, &size, f)) != -1) {
if (strstr(line, needle)) {
nokaslr = true;
printf("[.] Kernel was booted with KASLR disabled\n");
// printf("%s\n", line);
break;
}
}
fclose(f);
if (nokaslr)
return (unsigned long)KERNEL_TEXT_DEFAULT;
return 0;
}
int main() {
unsigned long addr = search_dmesg_kaslr_disabled();
if (!addr)
addr = search_dmesg_log_file_kaslr_disabled();
if (!addr)
return 1;
printf("common default kernel text for arch: %lx\n", addr);
return 0;
}