klange changed the topic of #osdev to: Operating System Development || Don't ask to ask---just ask! || For 3+ LoC, use a pastebin (for example https://gist.github.com/) || Stats + Old logs: http://osdev-logs.qzx.com New Logs: https://libera.irclog.whitequark.org/osdev || Visit https://wiki.osdev.org and https://forum.osdev.org || Books: https://wiki.osdev.org/Books
Left_Turn has quit [Read error: Connection reset by peer]
<mcrod> hi
<zid> heat: news is going on about image loader bugs in uefi, that secure thing you love that doesn't get hacked
dude12312414 has quit [Quit: THE RAM IS TOO DAMN HIGH]
<heat> zid, where??
<bslsk05> ​arstechnica.com: Just about every Windows and Linux device vulnerable to new LogoFAIL firmware attack | Ars Technica
<zid> heat: also is there a quick list of what all the functions are called in the uefi function pointer list somewhere?
<zid> I assume you could find one on google by slamming 5 of the names into a google search easily
<heat> oh
<heat> i thought it was about the PE image loader
<heat> anyway FUCKIN HILARIOUS LMAO
<heat> GET FUCKED
<heat> zid, wdym uefi function pointer list? you have like at least 30 different function pointer structs
<zid> fine, do 30 google searches for me
<bslsk05> ​uefi.org: UEFI Specification 2.10 — UEFI Specification 2.10 documentation
<zid> now process it for me
<heat> open the sections named "services - *" or "protocols - *"
elastic_dog has quit [Ping timeout: 240 seconds]
rpnx has joined #osdev
elastic_dog has joined #osdev
<heat> lol they defeated spectre mitigations with top byte ignore on AMD, ARM and Intel
<zid> I also ignore tops
<bl4ckb0ne> what about bottom byte
rpnx has quit [Quit: My laptop has gone to sleep.]
rustyy has quit [Ping timeout: 260 seconds]
agent314 has joined #osdev
<geist> hello
<heat> hi
<heat> geist, here's your monthly cpu vulnerability newsletter: https://download.vusec.net/papers/slam_sp24.pdf
<geist> ah hah we cant have nice things
<zid> nice things areillegal
<geist> not like top byte ignore and whantot is a ‘nice thing’ to kernel people. but the security people love it
<geist> until its terribad
<geist> because intel
<clever> i feel like thats the same as an xbox exploit
<clever> there was a bytecode intrepreter in the boot rom, that ran unsigned bytecode to bring up the dram
<clever> and to restrict what the unsigned code can do, it did a 32bit compare against the IO port being written to
<clever> except, the IO port is a 16bit number, the hardware ignores the upper 16bits :P
<heat> geist, doesn't TBI allow for hwasan»
<heat> and easier ways to stash random bits in a pointer, and we love those don't we
<zid> what's wrong with nanboxing, smh
<zid> people do silly things, then want hw support for their silly thing is the problem here, they should be content with wishing they had hw support
[itchyjunk] has quit [Read error: Connection reset by peer]
<geist> back in my day!
* geist shakes fist at people with their bits and memory
<zid> They'rejust greedy
<geist> we gave em 48 bits, they’re not even using it!
<geist> then they want to use the rest
srjek has quit [Ping timeout: 268 seconds]
<clever> geist: and dont forget about the good old A20 gate!
<heat> they should force-disable the A20 line again and lay out 64gigs of memory with A20 = 0
<clever> lol
edr has quit [Quit: Leaving]
heat has quit [Ping timeout: 276 seconds]
rustyy has joined #osdev
sbalmos has quit [Ping timeout: 256 seconds]
sbalmos has joined #osdev
Arthuria has joined #osdev
agent314 has quit [Ping timeout: 264 seconds]
Arthuria has quit [Killed (NickServ (GHOST command used by Guest684531))]
Arthuria has joined #osdev
agent314 has joined #osdev
Arthuria has quit [Remote host closed the connection]
Arthuria has joined #osdev
agent314 has quit [Ping timeout: 255 seconds]
eddof13 has quit [Quit: eddof13]
netbsduser has joined #osdev
GeDaMo has joined #osdev
Arthuria has quit [Remote host closed the connection]
netbsduser has quit [Ping timeout: 245 seconds]
alexander has quit [Remote host closed the connection]
alexander has joined #osdev
gbowne1 has quit [Quit: Leaving]
danilogondolfo has joined #osdev
Nixkernal has quit [Quit: https://quassel-irc.org - Chat comfortably. Anywhere.]
pretty_dumm_guy has joined #osdev
eddof13 has joined #osdev
zxrom has quit [Ping timeout: 256 seconds]
eddof13 has quit [Ping timeout: 246 seconds]
zid` has joined #osdev
zid has quit [Read error: Connection reset by peer]
heat has joined #osdev
elastic_dog has quit [Ping timeout: 240 seconds]
* Ermine tries hard to not use -en in $dayjob docs
<heat> docen
<heat> docken?
<Ermine> docker containen
<GeDaMo> Drunken
<GeDaMo> Hopefully the docs are not about Windows Eleven :P
<heat> windowen elevenen
elastic_dog has joined #osdev
kalj has joined #osdev
zxrom has joined #osdev
Nixkernal has joined #osdev
roper has joined #osdev
kalj has quit [Quit: Client closed]
goliath has joined #osdev
tomith has joined #osdev
srjek has joined #osdev
srjek has quit [Ping timeout: 268 seconds]
<benlyn>
<benlyn> INTERESTS
<benlyn> Arts & Culture, Books, Cars, Computer games, Music, Nature, Philosophy, Psychology, Sport, Theatre, Travelling
<benlyn> Spiritual:
<benlyn> Hobbies:
<benlyn> Astrology, Numerology, Tarot
benlyn has quit [Remote host closed the connection]
benlyn has joined #osdev
benlyn has quit [Remote host closed the connection]
Gurkenglas has joined #osdev
foudfou has joined #osdev
heat_ has joined #osdev
heat has quit [Read error: Connection reset by peer]
Left_Turn has joined #osdev
Gurkenglas has quit [Ping timeout: 250 seconds]
edr has joined #osdev
joe9 has joined #osdev
Left_Turn has quit [Ping timeout: 256 seconds]
Left_Turn has joined #osdev
srjek has joined #osdev
dude12312414 has joined #osdev
pebble has joined #osdev
foudfou has quit [Remote host closed the connection]
foudfou has joined #osdev
dude12312414 has quit [Quit: THE RAM IS TOO DAMN HIGH]
eddof13 has joined #osdev
eddof13 has quit [Quit: eddof13]
eddof13 has joined #osdev
craigo has joined #osdev
<immibis> the only spectre solution that actually works will be some kind of cache segregation
<immibis> which won't happen
eddof13 has quit [Quit: eddof13]
eddof13 has joined #osdev
eddof13 has quit [Client Quit]
eddof13 has joined #osdev
eddof13 has quit [Client Quit]
qubasa has quit [Remote host closed the connection]
Vercas has quit [Ping timeout: 240 seconds]
Vercas has joined #osdev
pebble has quit []
<gorgonical> How is it going on this Thursday afternoon my kernal developers
danilogondolfo has quit [Quit: Leaving]
<gorgonical> I have an actual question, too: why does musl ld.so use mmap MAP_FIXED to change permissions of a region and not mprotect?
<zid`> post your advent day 7 or riot
<gorgonical> I have difficulty completing the aoc. I have tried at least three times and never finished it
<zid`> MAP_FIXED is essentially dup2 isn't it
<zid`> nobody *finishes* aoc
<zid`> you get 2 weeks in then give up
<gorgonical> oh then I have done that several years now
<gorgonical> lol
<gorgonical> but yes map_fixed is basically the mmap variant of dup2 I think
<gorgonical> musl's ld.so uses it to map in rw segments because it already maps all the segments as ronly so it has to change some to rw
<gorgonical> I have heard glibc's does this too
<gorgonical> but mprotect does exactly the same thing as map_fixed with fd=-1 with much less overloading
<zid`> overloading?
<gorgonical> mmap is about mapping some data into memory. map fixed says put it where I want. map fixed with fd -1 says actually dont map new memory in, just change the mappings of old memory
<gorgonical> It does a new kind of job, one that mprotect already did
teroshan97 has quit [Quit: The Lounge - https://thelounge.chat]
<Ermine> Random questions time
<mjg> 9
<zid`> six
teroshan97 has joined #osdev
<Ermine> Seems like it's CRT which is responsible for setting proper memory protection
<zid`> if you want different to what ELF provides, sure
<gorgonical> right
<Ermine> Idk if I want, but strace on literally everything starts with a bunch of mprotect's
teroshan97 has quit [Client Quit]
<zid`> you -> the c environment
<gorgonical> And I mean here the ELF dynamic loader
teroshan97 has joined #osdev
<zid`> If your C implementation wishes for certain things to be true of the environment
<zid`> then the crt needs to do it before main()
<zid`> most of what a C environment wants is provided already by elf though, so they don't need to do things like zero their statics
<zid`> because elf provides functionality for this (.bss)
<gorgonical> yep
<Ermine> If I build my stuff crt-less (for whatever reason), do I get some default protection?
<gorgonical> yeah, whatever your elf segments say
<zid`> you get what your loader gave you
<zid`> which is probably, what you told your linker to tell your elf to give you
<gorgonical> yes, modulo what the loader does with them
<zid`> nommu systems aren't going to honor -w even if you ask for it, and some systems might enforce w^x without asking you, etc
<Ermine> don't they enforce w^x by default?
<zid`> who is they?
<Ermine> systems
<zid`> ?
<zid`> Only like, two systems even have that hardware
<zid`> and it's a global toggle on intel
<zid`> more or less
<gorgonical> we mean write but no exec right?
<zid`> write xor exec, neither, write or exec, but not write + exec
<gorgonical> oh
<zid`> intel implements it by the NX bit, bit 63 in the address, when the bit in cr..0? is set
<gorgonical> yeah for like instruction memory or kernel stuff
<zid`> windows calls it DEP I think
<Ermine> okay, thank you
<zid`> btw those mprotect that you are seeing
<zid`> are most likely a security feature to stop the GOT being writeable after ld.so fills it out
<zid`> it acts as a REALLY easy way to turn write gadgets into full exploits otherwise
<zid`> *printf = payload(); printf();
<zid`> 0x0804845f <+36>:call 0x8048300 <puts@plt>
<zid`> => 0x8048300 <puts@plt>:jmp DWORD PTR ds:0x804a00c
<zid`> so if you can write to 0x804a00c you can just turn any puts() in the original code into an arbitrary call to any address
<zid`> -Wl,-z,relro is what enables that
<zid`> which might be in your default gcc specs
<Ermine> it isn't
netbsduser has joined #osdev
<zid`> I get an entire extra mprotect with full relro
<zid`> DESKTOP-VCLC0NQ ~/dev/advent # gcc day7.c -o day7 -O2 -W -Wall -Wl,-z,now,-z,relro; strace ./day7 2>&1 -f | grep -E "(mmap|mprotect)" | wc -l
<zid`> 11
<zid`> DESKTOP-VCLC0NQ ~/dev/advent # gcc day7.c -o day7 -O2 -W -Wall -Wl,-z,lazy,-z,norelro; strace ./day7 2>&1 -f | grep -E "(mmap|mprotect)" | wc -l
<zid`> 10
<zid`> so there's two doing.. something else, as well
<zid`> (and 8 mmaps)
eddof13 has joined #osdev