Here we go, again ! Hi there! Happy New Year to you all.
Now I'm working hard on my final exams, so I don't have too much time on my hands. However, I made some little but not less important
improvements on my MODEST source code. Now, static or shared binaries share the very same routine when it comes to capturing their Ring 0 calls,
no matter whether they are issued through sysenter/sysexit or int $0x80/iret instructions pair. This way, now there's only one "peeping"
mechanism, thanks to kprobes Kernel aid.
All modified code is stored in our CVS project, here.
After a long break, these summer holidays have been exciting. There's a
white-paper explaining the latest
theoric-concepts applied to MODEST project so that now, and finally, it is capable of capturing the sys_write()
and sys_writev() system calls requested by any binary linked in a dynamic way.
There are a lof of demonstrative videos showing how MODEST can accomplish that, available at
VIDEOS section of the
website.
And, to conclude, there's a large post talkin' about this matter on Disbaux.es website.
Read it now.
About MODEST
MODEST is an experimental Linux Kernel Module designed so as to alter any
process File Descriptor Table at runtime, with no need to kill it previously
nor being affected by data loss.
All the code must be considered as an experimental one, not a stable one.
All tests were made using a Virtual Machine, as explained in
our paper and
in the INSTALL file.
Thus, there's absolutely no warranty about its own functionality outside a
well-known enviroment. If you are really in need of using MODEST in the real
world, do at your own risk and consequences: bear in mind bad things can
happen.
MODEST is based on some theoretical concepts involving GNU/Linux Kernel and
Operating Systems in general. It works only in GNU/Linux boxes running over i386
architectures. It is a 32 bit LKM piece of code, and all its design was made
using the GNU/Linux Kernel 2.6.18.1 aids. Of course it can be used, changing some
lines of code, on other kernel versions, probably.
Requisites
GNU/Linux Kernel 2.6.18.1, i386 architectures
Tested and developed on a Debian GNU/Linux Etch 32 bits, executed inside
a Virtual Machine thanks to VMware 6.X.
Status
One hundred per cent experimental. You have been warned ;-)!!
Maybe you are thinking about getting the fuck out of here right now, aren't you?
;-)
Some gossip ;-)
Presented and accepted in the VIII JPL, read the comments
here.
I wrote an spanish article for TL magazine,
here it is.
MODEST logo is not the first one designed by our Gimp expert Jugulator;
here you have the first one !!!
But, there's more, much more yet ! The second one can be found
right here !
Our article has been published on the VIII JPL's website. Read it
HERE.
I wrote a new article, posted directly on the CVS, concerning Kprobes and dynamic binaries. It's a latex,
'course, so you have to compile it before reading it. Get it
RIGHT HERE.
I would like to thank ...
the
Dark Fortress
band, for their good brutal melodic fuckin' black metal!
More foolish projects
ia32sh, completely behind the times now ... what a pitty! ;-)
sendMailer, it's been a so hard long time ... another age, a dark one I suppose ... so, no comments will be
made ... not now ... not by me ;-)!
rminode, a good idea,
but poorly developed. Who knows? Maybe it's time to fix it ...
netForo!, cool, a php based forum environment, with commands in the way of IRC old days!