关于在Linux的堆栈段执行代码的实践和思考

在内核态是可以执行的，具体代码如下：

具体平台信息为：

Linux ubuntu 2.6.32-38-generic #85-Ubuntu SMP Wed Jan 25 13:59:45 UTC 2012 i686 GNU/Linux

#include <linux/init.h>
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/miscdevice.h>
#include <linux/mutex.h>
#include <linux/compiler.h>
#include <linux/fs.h>
#include <linux/sched.h>
#include <linux/uaccess.h>
#include <linux/gfp.h>
MODULE_LICENSE("GPL");
MODULE_AUTHOR("Linmiaohe");
MODULE_DESCRIPTION("try to run func in privata kmalloc area");
typedef int (*func)(unsigned int);
int hello(unsigned int start)
{
return 0x61;
}
static int __init func_init(void)
{
unsigned int len = 0;
unsigned char *q = NULL;
unsigned char *p = NULL;
int i = 0;
func qq = NULL;
p = (unsigned char *)hello;
q = kmalloc(0x64,GFP_KERNEL);
/*0xc3 -->i686平台的ret指令的机器码*/
for(i = 0;p[i]!=0xc3;i++){
q[i] = p[i];
//printk(KERN_INFO "hello:%p:\t%02x\t",p+i,p[i]);
//printk(KERN_INFO "q:%p:\t%02x\t",q+i,q[i]);
}
q[i] = p[i];
//printk(KERN_INFO "hello:%p:\t%02x\t",p+i,p[i]);
//printk(KERN_INFO "q:%p:\t%02x\t",q+i,q[i]);
printk(KERN_INFO "len = 0x%x before hack\n",len);
//printk(KERN_INFO "i = %d\n",i);
qq = (func)q;
len = qq(0);
printk(KERN_INFO "len = 0x%x after hack\n",len);
printk(KERN_INFO "***********func module has been registered*************\n");
return 0;
}
static void __exit func_exit(void)
{
printk(KERN_INFO "***********func module has been unregistered*************\n");
}
module_init(func_init);
module_exit(func_exit);

编译加载模块并运行，得到结果如下：



可以看到，hello函数确实运行了(因为len的值确实被改变了)。

在用户态测试运行，代码如下：

#include<stdio.h>
#include<stdlib.h>
#include<string.h>
typedef int (*func)(unsigned int);
int hello(unsigned int start)
{
return 0x61;
}
int main(void)
{
unsigned int len = 0;
unsigned char *q = NULL;
unsigned char *p = NULL;
int i = 0;
func qq = NULL;
hello(0);
p = (unsigned char *)hello;
q = malloc(0x64);
for(i = 0;p[i]!=0xc3;i++){
q[i] = p[i];
//printf( "hello:%p:\t%02x\t\n",p+i,p[i]);
//printf( "q    :%p:\t%02x\t\n",q+i,q[i]);
}
q[i] = p[i];
//printf( "hello:%p:\t%02x\t\n",p+i,p[i]);
//printf( "q    :%p:\t%02x\t\n",q+i,q[i]);
printf( "len = 0x%x before hack\n",len);
//printf( "i = %d\n",i);
qq = (func)q;
len = qq(0);
printf( "len = 0x%x after hack\n",len);
return 0;
}

编译运行结果如下：



可见发生了段错误，查看一下内核log，可知发生了一般性保护异常(包含用来限制用户态的程序不能在堆栈运行代码的保护机制)：