3 ms·
Seems easily avoidable by having the modules rendezvous in one of the myriad ways that are possible given that both run in kernel mode with full privileges. Fo
by devit 3y ago
Seems easily avoidable by having the modules rendezvous in one of the myriad ways that are possible given that both run in kernel mode with full privileges.
For example, you can walk the kernel-only page tables, find all executable pages, and scan them for a magic string that the other module puts in their text section.
- drewg123 3y agoI was thinking the same thing, then I realized they don't even need this. They could simply grab the addresses via /proc/kallsysms and poke them into the driver using a custom helper to load the kernel module.