Intercepting the ELF bootloader in the linux kernel: file fs / binfmt_elf.c via the loadable kernel module

I am new to kernel coding, and I am currently working with ELF files that have been slightly modified for security purposes, for which I need to look at some of them in custom section headers and extract a unique code encryption key from this for the CPU to decrypt the contents modified ELF.

Currently, the above logic is implemented in a function load_elf_binaryin a file fs/binfmt_elf.cin the kernel source tree, however it is only about 250 lines of code for which I need to recompile the whole kernel, so I want to improvise this functionality by implementing it as a loadable kernel module (LKM), so that every time ELF is loaded, it checks whether its modified ELF is or not, and if it is then, it issues a key from the corresponding section.

EDIT: to summarize it, I want to make a loadable kernel module for reading ELF partitions and get the contents of a custom partition containing the encryption key and associated metadata, and set these values ​​to the CPU registers.

+4
source share
1 answer

, , . "kprobes", (. Documentation/kprobes.txt). , , , kprobe: jmp call .

- , Windows. , Windows , .

, , . ; . , , .

+3

All Articles