PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Linux kernel instrumentation from Qemu and Gdb

blog.quarkslab.com | research | #reverse-engineering | #linux-kernel | #debugging | #instrumentation | #gdb | #qemu
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A tutorial on instrumenting the Linux kernel from QEMU and GDB: using a hypervisor for stealthy analysis, plus GDB scripting and kernel helper tools to monitor syscalls, processes and modules.
Published
Collected

Related coverage

research · github.com
Infinity Core: Linux Kernel Core Subsystems LPE and Container Escape Research
Unlike most modern Linux kernel exploits that depend on networking, eBPF, or unprivileged user namespaces, these vulnerabilities reside in fundamental kernel core subsystems, rendering standard container sandboxes and Android application domain restrictions ineffective against local privilege escalation.
blog · blog.trailofbits.com
“Unstripping” binaries: Restoring debugging information in GDB with Pwndbg
Trail of Bits extends Pwndbg with Binary Ninja integration—syncing symbols, signatures, and stack variables with decompilation—and Go type parsing to debug stripped binaries in GDB more like an IDE.
blog · blog.trailofbits.com
A Winter’s Tale: Improving messages and types in GDB’s Python API
A Trail of Bits associate describes work to speed up GDB and improve its Python API, covering parallel symbol loading, obstack internals, __repr__ methods, and types support benefiting Pwndbg.
research · blog.quarkslab.com
Bypassing Android Hardware Attestation from the Analyst's Chair
Hardware key attestation lets an Android app prove to its backend that a key lives in secure hardware on a locked, verified device. It is also the wall that stops a security analyst working on a rooted phone. This article opens the mechanism from the analyst's chair, from the certificate chain and the attestation extension down to the root of trust, then shows a simple bypass that never touches the secure hardware. We relay the attestation to a clean device and splice a genuine chain back into the target app with a Frida hook. A companion repository ships the validation backend, the demo apps and the instrumentation, so the whole setup can be run and inspected rather than taken on faith.
research · blog.quarkslab.com
Debugging Windows Isolated User Mode (IUM) Processes
How to debug Windows Isolated User Mode (IUM) processes, aka Trustlets: using Hyper-V's virtual TPM as the target, with background on Virtual Secure Mode and Virtual Trust Levels.
research · blog.quarkslab.com
Android greybox fuzzing with AFL++ Frida mode
How to greybox-fuzz native Android userland targets directly on a device with AFL++'s Frida mode, including strategies for fuzzing JNI functions that interact with Java bytecode.
Back