| 00:33.54 | *** join/#openezx ljp (n=lpotter@203.94.178.46) |
| 02:18.31 | *** join/#openezx leoncamel (n=leoncame@219.238.107.107) |
| 05:07.49 | *** join/#openezx proberts_ (n=proberts@67-20-86-248.vnnyca.adelphia.net) |
| 05:35.27 | *** join/#openezx LoneStar (n=xinzhen@211.144.200.92) |
| 05:44.04 | *** join/#openezx |dion| (n=dionua@xen.inhex.net) |
| 07:34.53 | *** join/#openezx blkhawk[work] (n=blkhawk@IP-213157024141.dialin.heagmedianet.de) |
| 08:06.13 | stefan_schmidt | hi all |
| 08:59.32 | *** join/#openezx florian_kc (n=fuchs@dns.kernelconcepts.de) |
| 09:06.46 | florian_kc | good morning |
| 09:06.46 | stefan_schmidt | morning florian_kc |
| 09:12.39 | *** join/#openezx ao2 (n=u@2001:1418:117:0:0:0:0:1) |
| 09:33.24 | *** join/#openezx ade|desk (n=ADAVEY@194.200.143.249) |
| 09:34.49 | Hopscotch | good morning |
| 09:36.00 | ade|desk | morning |
| 10:13.14 | stefan_schmidt | hi Hopscotch, ade|desk |
| 11:04.03 | *** join/#openezx seventyeight (n=ochse@dslb-088-072-225-210.pools.arcor-ip.net) |
| 11:23.55 | ade|desk | stefan_schmidt: which weekend are you doing your major hacking ? |
| 11:24.28 | stefan_schmidt | ade|desk: next |
| 11:24.47 | ade|desk | as in 5 days time |
| 11:26.09 | stefan_schmidt | jip |
| 11:26.11 | stefan_schmidt | yes |
| 11:27.44 | ade|desk | nice |
| 11:28.03 | florian_kc | oh, that's nice |
| 11:28.10 | stefan_schmidt | yes |
| 11:28.29 | ade|desk | how good is the usb over the parallel? |
| 11:28.51 | stefan_schmidt | http://www.amontec.com/jtagkey-tiny.shtml |
| 11:28.59 | stefan_schmidt | ade|desk: faster clock |
| 11:29.27 | stefan_schmidt | it's the small blue thing betwenn board and cable :) |
| 11:29.55 | ade|desk | hehe, i gathered |
| 11:50.18 | [g2] | stefan_schmidt morning |
| 11:50.31 | [g2] | so a tiny ? |
| 11:50.32 | stefan_schmidt | morning [g2] |
| 11:50.55 | stefan_schmidt | [g2]: Yes. vmaster pointed me to a free lib to drive it |
| 11:51.05 | [g2] | cool! |
| 11:51.25 | stefan_schmidt | [g2]: As I have the choice now between binary only or free lib the tiny is totaly fine. |
| 11:51.39 | stefan_schmidt | [g2]: And it is sweet. :) |
| 11:52.01 | [g2] | it's on the way right ? |
| 11:52.20 | [g2] | the choice is sweet, correct ? |
| 11:52.46 | stefan_schmidt | correct |
| 11:52.57 | stefan_schmidt | the order is out right now |
| 11:53.05 | [g2] | excellent :) |
| 11:53.07 | stefan_schmidt | Should be here in 4 days. |
| 11:53.31 | stefan_schmidt | Should be here before the weekend. :) |
| 11:53.47 | [g2] | that's enough time to warm up the soldering iron and get ready for the new "baby" to arrive :) |
| 11:53.57 | [g2] | get it's "room" ready |
| 12:13.55 | stefan_schmidt | heh |
| 13:11.20 | *** join/#openezx nh_work (n=nh@aurora.msi.umn.edu) |
| 13:44.24 | *** join/#openezx ao2 (n=u@2001:1418:117:0:0:0:0:1) |
| 14:39.03 | *** join/#openezx ao2 (n=u@2001:1418:117:0:0:0:0:1) |
| 17:02.05 | *** join/#openezx vmaster_ (i=vmaster@p549B51E7.dip.t-dialin.net) |
| 17:09.48 | *** join/#openezx kenws (n=ken@dslb-088-064-131-179.pools.arcor-ip.net) |
| 17:16.20 | *** join/#openezx LoneStar (n=xinzhen@222.67.171.217) |
| 17:17.20 | *** join/#openezx pleemans (n=peter@d51A5E421.access.telenet.be) |
| 17:33.05 | *** join/#openezx florian (n=fuchs@84.245.175.111) |
| 17:44.16 | *** join/#openezx letoto (n=paul@tla.xelerance.com) |
| 18:13.55 | *** join/#openezx vmaster_ (i=vmaster@p549B7C71.dip.t-dialin.net) |
| 18:37.31 | proberts | nh_work: Have you by chance found a sfb file for 33P anywhere? |
| 18:37.54 | nh_work | proberts: I believe I saw reference to one on one of the boards... |
| 18:38.01 | nh_work | proberts: did you brick your phone? |
| 18:39.14 | proberts | No - going to try to flash a modified acpolicy.cfg to the phone to turn off se... but I want to try it with 33P rather than the modded ROMs I've found. |
| 18:40.06 | nh_work | ah... |
| 18:40.33 | nh_work | I'm not sure. Might want to look around on motomodders.net or e2mod.com |
| 18:41.18 | proberts | E2 only had 29P and 36P (and higher) |
| 18:41.28 | nh_work | ah |
| 18:43.32 | nh_work | proberts: I got your email about the acpolicy.cfg being read-only, and saw some of your other updates on the wiki. Have you figured anything else out? |
| 18:43.54 | nh_work | I've been incredibly busy with work/pregnant wife. :) |
| 18:44.00 | proberts | freemod.net has a bunch as well- even an "official" 43P. Is Motorola just really far behind releasing the GPL updates? |
| 18:44.54 | nh_work | proberts: technically I don't think any of them have been officially offered, so they may not be violating the GPL. |
| 18:45.04 | nh_work | But I don't know about 43P. |
| 18:45.43 | nh_work | Or the legality of the bootloader stuff. |
| 18:46.04 | proberts | nh_work: Not much other than what's on the Wiki. I've been working to get our app ported over and writing a gfx/audio/input lib. |
| 18:46.16 | nh_work | proberts: how's that going? |
| 18:47.18 | proberts | Oh - I do think it will be possible (at least with the E2 using the sfb files... don't know about shx files) to make a OpenEZX sfb flash file that will work like a regular Mot flash update and have it only contain and modify the kernel and linux fs memories. |
| 18:47.43 | letoto | proberts: that's on purpose |
| 18:47.51 | letoto | delaying GPL releasing. |
| 18:47.59 | letoto | by the time the ocmmunity gets to it, phone is obsolete |
| 18:48.33 | proberts | tha app is going well. Everything compiles so far and I have gfx and audio working. I can control the backlight as well. Having a little harder time with intercepting keypad input. |
| 18:49.31 | nh_work | proberts: If we can just modify the acpolicy.cfg file that would be ideal for now. |
| 18:50.14 | nh_work | Though I imagine that's probably harder than just flashing a new kernel. |
| 18:50.33 | proberts | I may just go ahead and try that with the 43P build. The ezxflash toolkit should let me do it (hopefully if I only try to flash a modded root fs, I can still revert flash it back if I screw it up) |
| 18:51.42 | proberts | nh_work: What I'm going to try is pointing the selinux file policies to nonexistnant directories (ie. make /usr/* into /foo/* ). I may get a chance to try it tonight. |
| 18:53.05 | nh_work | proberts: is there a reason to make them point at non-existant directories instead of real ones that are pointless? That might be safer. :) |
| 18:54.48 | proberts | nh_work: Good thought. I'll try that if it doesn't work. |
| 18:56.15 | nh_work | proberts: so are you planning on both changing the acpolicy.cfg file and the kernel? |
| 18:56.25 | proberts | no, just the policy file. |
| 18:56.36 | nh_work | ah, ok. That's good. |
| 18:57.33 | proberts | I did find the kernel args and was hoping to find something in the selinux source I could pass to disable it, but no such luck as of yet. |
| 18:57.34 | nh_work | proberts: yeah, that's what I was going to try to look for next. |
| 18:57.42 | nh_work | proberts: you can do it in SELinux, but I have no idea about the motoac stuff. |
| 18:57.57 | proberts | I was hoping to figure out a solution that didn't involve flashing. |
| 18:58.10 | nh_work | I don't know how kernel args get passed from the bootloader etiher. |
| 18:59.14 | proberts | They're stored in one of the mtd partitions as a ASCII string... there appears to be about 30-40 bytes of extra space we could stuff more args into. |
| 19:00.31 | nh_work | really? Well, you may try "SELINUX=disabled" |
| 19:00.51 | nh_work | maybe see if you can find that in the kernel source first. |
| 19:00.59 | proberts | (looking) |
| 19:01.06 | nh_work | SELINUX=0 too. |
| 19:01.15 | nh_work | er, selinux=0 |
| 19:01.51 | nh_work | SELINUX=disabled appears to be for /et/selinux/config |
| 19:02.11 | nh_work | selinux=0 is supposedly the boot line. |
| 19:05.39 | proberts | hmmm... what mechanism would the kernel use to pass parameters to the selinux .o? |
| 19:06.30 | letoto | cant we pass selinux=0 in the bootloader to the kernel? |
| 19:08.39 | proberts | hmm... I did a grep -Ri for "selinux" (with the quotes) on the whole 33P tree and got nothing. |
| 19:09.06 | proberts | How does a module get the passed kernel parameters? |
| 19:26.44 | *** join/#openezx |dion| (n=dionua@xen.inhex.net) |
| 19:39.54 | *** join/#openezx stefan_schmidt (n=stefan@p3EE2F534.dip.t-dialin.net) |
| 19:40.17 | stefan_schmidt | re |
| 19:47.35 | proberts | hi |
| 19:50.06 | stefan_schmidt | hi proberts |
| 19:51.30 | proberts | stefan_schmidt: (Does Harald/LaF0rge ever come on the board? I emailed asking for permission to wikify and post something he wrote about EZX.) |
| 19:52.24 | stefan_schmidt | proberts: He is more then busy right now. 12 hour hacking session every day to get openmoko ready. |
| 19:53.14 | stefan_schmidt | proberts: What where you asking for? |
| 19:54.10 | stefan_schmidt | proberts: http://gnumonks.org/~laforge/weblog/2006/11/25#20061125-foss_in-sorry |
| 19:55.17 | proberts | stefan_schmidt: I wanted to post a wikification of a pdf I found of slides he made for a overview of EZX hardware |
| 19:56.04 | stefan_schmidt | proberts: hmm, do you have a link for me? |
| 19:57.00 | stefan_schmidt | proberts: I already used some of his slides in my own presentations with his permission |
| 19:57.24 | stefan_schmidt | proberts: It should not be a problem, but I like to look at it before. |
| 19:57.42 | proberts | stefan_schmidt: Looking for PDF... I have my wikified version. |
| 19:59.01 | proberts | http://events.ccc.de/congress/2005/fahrplan/attachments/677-FreeSoftwareGSMPhone-Slides.pdf |
| 20:00.00 | stefan_schmidt | proberts: ah, the first presentation at ccc. |
| 20:00.24 | stefan_schmidt | proberts: That's the one I used for ma presentation, too. |
| 20:00.38 | stefan_schmidt | proberts: Should not be a problem to wikify. |
| 20:00.59 | proberts | for me, it really did a good job helping me understand the relationship between the different hardware units. I wanted to wiki the parts I found useful as a "Hardware Overview". |
| 20:01.35 | stefan_schmidt | proberts: Just do it. I there is a problem I clarify it with harald |
| 20:01.47 | proberts | ok.. thanks. |
| 20:04.07 | nh_work | proberts: sorry, I'm jumping between various meetings. Where you able to figure out the kernels args passing? |
| 20:23.58 | proberts | No, I don't see anything in the security folder sources that looks for arguments, but I haven't dug too deep yet. |
| 20:27.10 | *** join/#openezx frank_ (n=ochse@dslb-088-072-225-210.pools.arcor-ip.net) |
| 20:29.39 | letoto | what bootloader is used anyway? |
| 20:32.00 | stefan_schmidt | letoto: modified blob |
| 20:32.14 | stefan_schmidt | letoto: Sources are available |
| 20:34.25 | letoto | so it should be possible to pass selinux=0 as boot arg |
| 20:34.34 | letoto | unless motorola modified the kernel to set/ignore it |
| 20:35.18 | proberts | stefan_schmidt: BTW - I think it should be possible to create a sfb (flash file for the ROKR-E2) for OpenEZX that only contains the oezx kernel and filesystems, and have it only flash those areas of the phone. |
| 20:36.18 | letoto | proberts: rokr-e2/e3 are supposed by openezx? |
| 20:36.26 | letoto | might be a better candidate to buy then the a780 then |
| 20:37.57 | proberts | stefan_schmidt: That way you won't get a ton of emails saying "I double-clicked on the 'INSTALL' file, but Windows doesn't know what to do with it" ;P |
| 20:39.32 | proberts | letoto: E2 isn't a significantly different platform (at least so far). No touch screen though. |
| 20:40.48 | letoto | proberts: The a780 can only be bought from discount stores selling obsolete stock |
| 20:41.16 | proberts | letoto: Has Motorola stopped making it? |
| 20:46.03 | letoto | proberts: telco's stopped promoting/selling it |
| 20:46.26 | letoto | it's all razor / v3 /rokr now |
| 20:46.29 | proberts | letoto: What territory are you in? |
| 20:46.34 | letoto | canada |
| 20:46.56 | proberts | letoto: Wow - what carrier was selling the A780 there? |
| 20:56.49 | letoto | proberts: there is only one carrier for GSM, that's Rogers/Fido |
| 20:57.57 | *** join/#openezx stefan_schmidt (n=stefan@p3EE2F534.dip.t-dialin.net) |
| 21:22.44 | *** join/#openezx TimRiker (n=timr@pdpc/supporter/bronze/TimRiker) |
| 21:27.12 | nh_work | proberts: do you know how motoac and selinux are tied together? |
| 21:30.45 | nh_work | It looks like in at least some version of selinux, there is supposed to be a SECURITY_SELINUX_BOOTPARAM option, but I'm not seeing any reference to it in the code. |
| 21:31.05 | proberts | motoac replaces the default policy for selinux |
| 21:31.15 | nh_work | proberts: does it replace it entirely? |
| 21:31.26 | proberts | yeah - it looks like it. |
| 21:32.24 | nh_work | proberts: ok, that's what I wasn't sure about. It appears to provide the whole security interface for the kernel, but I wasn't sure if it eventually called anything in the selinux directory included with the kernel. |
| 21:32.26 | letoto | wonder if you can write a kernel module that overloads the selinux function and just ignores it |
| 21:34.19 | nh_work | letoto: a friend of mine suggested something similar. I tried to load one of the unloaded modules on the phone and it complained about memory. |
| 21:34.38 | proberts | I was able to get the logger module to load |
| 21:34.45 | nh_work | proberts: that's what I tried to load. |
| 21:34.58 | nh_work | proberts: did it just work? |
| 21:35.37 | proberts | as far as I could tell. It kicked my telnet session and the phone's UI was really sluggish... so I'm guessing it was logging something... just not sure what and to where. |
| 21:36.44 | nh_work | proberts: when I tried it my telnet connection got kicked, but not before I got a message complaining about memory. I couldn't regain telnet without restarting the phone. |
| 21:37.48 | proberts | I didn't get any message. I think all I needed to do was restart inetd to get back in. |
| 21:38.21 | letoto | nh/proberts: which motorola are you guys using? |
| 21:38.27 | proberts | I ended up resetting the phone because it was running so slow... actually, yeah - I did get back in after restarting inetd, because I checked if logger was loaded with lsmod. |
| 21:38.33 | proberts | ROKR E2 |
| 21:38.36 | nh_work | letoto: E2 as well. |
| 21:39.17 | nh_work | proberts: hrm... might be worth seeing if we can figure out where it's trying to log to and what it's logging. |
| 21:40.19 | letoto | that one is $340 canadian |
| 21:40.27 | letoto | $40 more then the a780 |
| 21:40.55 | letoto | the rokr e1 is $200 |
| 21:41.02 | letoto | does that one work with openezx? |
| 21:41.11 | proberts | No, E1 is P2K |
| 21:41.42 | letoto | oki |
| 21:41.46 | proberts | I picked up the ROKR E2 for $199 USD. Going price seems to be about $225 USD on ebay. |
| 21:41.51 | letoto | so any gain in the E2 over the A780? |
| 21:42.08 | nh_work | letoto: http://www.puremobile.ca/itemdesc.asp?ic=100-2862 |
| 21:42.15 | nh_work | $295ca |
| 21:42.21 | nh_work | those guys are great too. |
| 21:42.38 | nh_work | I got my phone shipped to the US in 17 hours. |
| 21:43.30 | letoto | cool. thanks |
| 21:43.45 | letoto | so that's equally expensive to the A780 |
| 21:44.04 | letoto | http://www.tigerdirect.ca/applications/searchtools/item-Details.asp?EdpNo=2219332&sku=M151-2054 |
| 21:44.26 | nh_work | letoto: it's smaller than the A780 |
| 21:44.39 | proberts | letoto: E2 has keypad/dpad, no touchscreen. E2 is marketed as a music phone (has player buttons on side, takes normal headphones, uses std. SD cards, has an empty ITUNES mtd partition :P ) |
| 21:45.07 | nh_work | proberts: yeah, the empty ITUNES partition is rather humorous. :) |
| 21:46.00 | nh_work | letoto: A780 is 107x53x24mm, E2 is 106x50x18mm |
| 21:47.13 | letoto | http://www.tigerdirect.com/applications/SearchTools/item-details.asp?EdpNo=2442368 |
| 21:47.16 | letoto | ah also $300 there |
| 21:48.34 | letoto | hmm so the rokr takes sdcards, instead of micrcoSD/transflash |
| 21:48.39 | nh_work | yep |
| 21:48.45 | letoto | and i already have a 512mb sd card |
| 21:48.53 | letoto | so that saves me like $100 |
| 21:49.18 | nh_work | the rokr is a nice phone, just will take a bit to figure out how to modify it. |
| 21:49.30 | letoto | it's not as far ahead as the a780? |
| 21:49.32 | nh_work | though hopefully proberts will be successful tonight. :D |
| 21:49.59 | nh_work | letoto: it's much newer, and motorola has their custom access control stuff we need to get past. |
| 21:51.13 | letoto | the a780 doesnt have selinux stuff? |
| 21:51.22 | nh_work | nope |
| 21:51.30 | nh_work | only the a1200 and E2 do so far. |
| 21:51.46 | letoto | so how is that limited you? |
| 21:51.51 | letoto | you can't build a non-selinux kernel ? |
| 21:51.54 | letoto | boot |
| 21:52.04 | letoto | or do you then also have a 30second issue? |
| 21:52.05 | nh_work | letoto: they restrict write access to parts of the phone. |
| 21:52.21 | stefan_schmidt | letoto: boot over usb is disbaled on this phones, too. |
| 21:52.38 | nh_work | stefan: someone was saying it "should" work, but for some reason it's not. |
| 21:52.50 | nh_work | I forget where I read that. |
| 21:52.58 | stefan_schmidt | letoto: Flash should work, but people don't like to do this with his day-by-day phone in such an early state. :) |
| 21:53.19 | letoto | stefan_schmidt: can you flash back? :) |
| 21:53.26 | letoto | the phone I'm getting is purely for experimenting |
| 21:53.29 | letoto | so i dont care :) |
| 21:53.37 | stefan_schmidt | nh_work: hmm, imho somebody reported that he flashed a modified kernel to an A1200 on the ml. |
| 21:53.44 | letoto | I just need to decide on a phone, caus egreen phone openmoko wont happen im time ofr me |
| 21:54.18 | nh_work | stefan: yeah, I heard about that. Someone else was claiming they got an a1200 image to flash on an E2 as well (and even sort of work). |
| 21:54.18 | stefan_schmidt | letoto: Flash back is a big problem right know. |
| 21:54.39 | nh_work | anyway, gotta run. ttyl guys |
| 21:54.44 | letoto | ok. so i might settle on the a780 then :) |
| 21:54.45 | proberts | later\ |
| 21:54.51 | letoto | thanks for the info guys! |
| 21:54.57 | stefan_schmidt | letoto: You need original firmware for it, which is illegal to distribute. |
| 21:55.09 | stefan_schmidt | letoto: At least moto don't offer them |
| 21:55.21 | stefan_schmidt | bye nh_work |
| 21:55.24 | letoto | you need original formware for what? |
| 21:55.29 | letoto | to flash back ? |
| 21:55.40 | stefan_schmidt | letoto: yes |
| 21:56.55 | stefan_schmidt | letoto: At least if you f**k up the phone while flashing |
| 22:01.45 | proberts | stefan_schmidt: With the ezxflash tool, is there no way to suck the firmware out of the phone? (Or does ezxflash only support writing)? |
| 22:02.59 | stefan_schmidt | proberts: There is a small piece of code which is loaded into ram first and handles the flashing |
| 22:03.31 | stefan_schmidt | proberts: This one is inside the firmware images. I guess it's not an the installed software |
| 22:04.16 | stefan_schmidt | s/an/on/ |
| 22:04.53 | proberts | stefan_schmidt: Hmmm... so one of the code groups has the program in it? |
| 22:05.14 | stefan_schmidt | proberts: right |
| 22:06.50 | proberts | What happens if you turn that codegroup off and try to flash the phone? |
| 22:08.17 | stefan_schmidt | I can't try. Just repeating what I read. |
| 22:08.28 | stefan_schmidt | But I can guess. |
| 22:08.45 | proberts | what's your guess? :) |
| 22:08.57 | stefan_schmidt | It is the first piece of code which is loaded into ram. If it is not there, falshing will stop. |
| 22:14.21 | *** join/#openezx nh_home (n=nh@aurora.msi.umn.edu) |
| 22:14.28 | stefan_schmidt | wb nh_home |
| 22:14.32 | nh_home | thanks. :) |
| 22:15.33 | nh_home | proberts: kind of funny seeing what they took out of selinux for motoac. |
| 22:18.33 | proberts | nh_home: Did you get a reply yet from the selinux guy you emailed? |
| 22:21.06 | nh_home | yeah, he didn't say much. |
| 22:21.46 | nh_home | Basically that he didn't look into it any further and that it's just a hacked up version of a really old SELinux. He went on to say "You can probably just allow all accesses to all processes somehow." :) |
| 22:22.11 | stefan_schmidt | wb mickeyl |
| 22:24.42 | proberts | hmmm... I wonder at what level the motoac/selinux resolves symlinks? |
| 22:26.13 | nh_home | proberts: no idea... |
| 22:26.29 | nh_home | proberts: though I didn't see anything fancy in the code. |
| 22:26.45 | mickeyl | heya |
| 22:27.09 | nh_home | are you thinking the acpolicy.cfg file or for policy rules? |
| 22:28.00 | mickeyl | TimRiker: our apt is gone from #openmoko... we miss him! |
| 22:28.48 | proberts | ...wait a sec! (don't have the phone to check this) If root has access to kmem, it might be possible to find the policy struct in memory and overwrite the policies and domains. |
| 22:29.15 | nh_home | hrm.... |
| 22:30.09 | *** join/#openezx kenws (n=ken@dslb-088-064-131-179.pools.arcor-ip.net) |
| 22:40.40 | nh_home | proberts: /dev/kmem isn't listed in the policy file. |
| 22:40.54 | nh_home | it looks like /dev/wtm, /dev/mtd* and /dev/sideband are. |
| 22:41.15 | proberts | I think those are only policy'ed for user ezx though, right? |
| 22:41.23 | nh_home | not sure |
| 22:42.02 | nh_home | according to your post about the root user your are probably correct. :) |
| 22:42.35 | proberts | Do you have a telnet session open on the phone by any chance? :) |
| 22:43.07 | nh_home | I do. :) |
| 22:44.35 | nh_home | # ls -al /dev/kmem |
| 22:44.36 | nh_home | crw-r----- 1 root root 1, 2 Dec 31 1999 /dev/kmem |
| 22:44.40 | proberts | can you try a 'grep ac_getflexbit /dev/kmem'? (Sorry - I intentionally didn't bring my E2 to work so I could actually get some work done. :P ) |
| 22:45.06 | proberts | Nice - so owned by root and +w. |
| 22:45.44 | proberts | If this works, we need to figure out how we hide what we're doing to disable selinux so Motorola doesn't just simply add /dev/kmem to the policy file. |
| 22:46.05 | stefan_schmidt | heh |
| 22:46.32 | nh_home | proberts: doh |
| 22:46.38 | nh_home | oh wait |
| 22:46.42 | nh_home | wrong terminal! :) |
| 22:46.58 | stefan_schmidt | lol |
| 22:47.08 | nh_home | # grep ac_getflexbit /dev/kmem |
| 22:47.09 | nh_home | Segmentation fault |
| 22:47.11 | nh_home | heh |
| 22:47.25 | proberts | I guess we can obfuscate the code like crazy and hope they don't ltrace it. |
| 22:48.38 | proberts | hmmm... not sure how grep opens files... normally strings | grep, but no strings on E2... |
| 22:48.56 | proberts | maybe try cat /dev/kmem | grep ac_getflexbit |
| 22:49.12 | nh_home | # cat /dev/kmem > /mmc/mmca1/kmem.dump |
| 22:49.13 | nh_home | Segmentation fault |
| 22:50.16 | proberts | maybe try dd |
| 22:50.48 | nh_home | hrm. Can I just dd the device to a file? |
| 22:51.04 | proberts | yeah. |
| 22:51.38 | proberts | Hopefully it contains the policy strings in straight ascii. |
| 22:51.40 | nh_home | so something like dd if=/dev/kmem of=/mmc/mmca1/kmem.dump? |
| 22:51.51 | proberts | yeah... should work |
| 22:52.18 | nh_home | segfault. :( |
| 22:52.44 | proberts | Hmmm... maybe some write-only regs mapped into kernel address space. |
| 22:55.35 | proberts | Is there a /proc/ksyms |
| 22:56.02 | nh_home | yeah |
| 22:56.13 | nh_home | I can read it too |
| 22:56.26 | proberts | Does it provide any info? |
| 22:56.35 | proberts | (when cat'ed) |
| 22:59.12 | nh_home | not as much as I had hoped. |
| 22:59.19 | nh_home | lots of info, not sure how much is useful though. |
| 22:59.35 | nh_home | some stuff about moto_accy |
| 23:00.07 | proberts | Hmmm... ksyms may only be for dynamic modules... |
| 23:00.13 | nh_home | also some stuff about kmem |
| 23:02.39 | nh_home | I get a segfault trying to read /dev/mem as well, but doesn't ps need to access that? |
| 23:03.05 | *** join/#openezx nevarrie_ (n=jgrant@CPE-72-128-35-75.kc.res.rr.com) |
| 23:03.52 | proberts | the segfault is probably happening at a specific address (mapped write-only register). If a program knows where to look, it shouldn't have problems. |
| 23:04.08 | nh_home | ah |
| 23:04.54 | nh_home | hrm... can't you just trap/ignore seg faults anyway? |
| 23:05.44 | proberts | one fun thing you can do if the sysadmin hasn't locked /dev/mem is get them to su root on your workstation to fix something, the run strings on dev/mem to get the root password (it'll usually be there as ascii) |
| 23:06.21 | nh_home | yikes |
| 23:06.25 | proberts | Yeah - I think they can be trapped, |
| 23:07.17 | proberts | There's smarter ways to read the kmem file though and find symbols- rather than a brute-force string search. |
| 23:08.40 | *** join/#openezx florian (n=fuchs@84-245-188-248.dus.bpool.celox.de) |
| 23:09.01 | nh_home | http://doc.bughunter.net/rootkit-backdoor/kmem-patching.html |
| 23:14.43 | nh_home | heh, cat /proc/kmsg certainly yields a lot of text. :) |
| 23:15.16 | proberts | yeah - try grep -v to get rid of the power messages, the place a phone call and watch the output. |
| 23:15.58 | *** join/#openezx stefan_schmidt (n=stefan@p3EE2F534.dip.t-dialin.net) |
| 23:17.44 | nh_home | so er, what about /proc/kcore? |
| 23:18.16 | proberts | kcore is a dynamic core file for the running kernel. |
| 23:19.15 | nh_home | proberts: so, could we run a strings against it and see anything interesting? ac_getflexbit was found in the binary file... |
| 23:19.24 | proberts | ...I'm not sure if the kernel is completely stripped if symbols can be resolved from it. But, I don't think you can write to kcore. |
| 23:19.40 | nh_home | yeah, it's mounted read only. |
| 23:19.55 | nh_home | It claims to be 218MB. |
| 23:19.58 | florian | re |
| 23:20.11 | florian | a1200 hacking? |
| 23:20.16 | nh_home | florian: E2 |
| 23:20.19 | proberts | Yeah - I was looking to see how many times the string "ac_getflexbit" appeared, since it's part of the policy file. |
| 23:20.41 | florian | ah cool |
| 23:20.43 | proberts | The idea would be to just overwrite the motoac struct as it is in memory. |
| 23:20.54 | proberts | (using /dev/kmem or /dev/mem) |
| 23:22.03 | nh_home | proberts: yeah, you'll have to teach me how to more elegantly read /dev/mem to get around the segfaults. ;) |
| 23:23.37 | proberts | When I get home I can write some code to search for the policy strings. |
| 23:24.23 | nh_home | proberts: true, you have a cross compile environment setup don't you. |
| 23:25.36 | proberts | Yeah - at home. |
| 23:26.05 | nh_home | nice |
| 23:26.11 | proberts | Did you get a toolchain set up yet? |
| 23:26.31 | nh_home | proberts: naw, I haven't had time to do much of anything on my phone. |
| 23:26.48 | nh_home | This is the first time I've really gotten to sit down and play with it in a while. |
| 23:31.24 | nh_home | hrm... http://lists.arm.linux.org.uk/pipermail/linux-arm-kernel/2005-November/032390.html |
| 23:32.37 | proberts | the ezx-dev package worked really well on my m64 machine. The test app won't compile because the libs are named differently on the E2. |
| 23:36.46 | proberts | but if you fix the makefile everything is fine. The install was flawless. The guy did a good job writing it. |
| 23:39.16 | nh_home | good deal. I need to get my wireless card working here |
| 23:59.59 | nh_home | proberts: Are you on the west coast? |