⬢ DragonFlyBSD Kernel Audit
DF-5672 / disasm_live.sh
← back to finding ↓ download raw
#!/bin/sh
# DF-5672 evidence: disassemble the DO_SETBITS-generated pend functions in the
# RUNNING guest's kernel image and show the splz crit-section self-guard.
# Demonstrates: gd_spending store is an UNLOCKED 'orl' while gd_reqflags store
# is a 'lock orl' -- the reverse of what the comment at ipl_funcs.c:42 asserts.
K=/boot/kernel/kernel
echo "kernel: $K ($(uname -r))"
for f in setdelayed setsoftcamnet setsoftcambio setsofttty setsoftvm setsofttq setsoftcrypto schedsofttty; do
  a=$(nm -an $K | grep " $f\$" | cut -d' ' -f1)
  if [ -z "$a" ]; then echo "== $f NOT FOUND"; continue; fi
  echo "== $f @ 0x$a"
  objdump -d --start-address=0x$a --stop-address=$((0x$a+32)) $K | sed -n '/^[ \t]*[0-9a-f]*:/p'
done
echo "== splz (critcount self-guard)"
A=$(nm -an $K | grep " splz\$" | cut -d' ' -f1)
objdump -d --start-address=0x$A --stop-address=$((0x$A+24)) $K | sed -n '/^[ \t]*[0-9a-f]*:/p'
echo "== live machinery counters"
vmstat -i | head -14
sysctl lwkt.ipiq_count