August 2007 - Darwin-kernel

RE: virus scan application
by Vishal Shetye 04 Aug '07

04 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:from:to:cc:references:subject:date:message-id:mime-version:content-type:content-transfer-encoding:x-mailer:thread-index:in-reply-to:x-mimeole; b=TpwvYhjCupdOq1cyHIL2ISTb6tnMBBMlF5iX3GrWqRevz05pfzxZv34UnH+Y03RIFZqS8m9PccO5ciKfSS468XXk0EQVWJpCfntAohHUOOC3Na7HM9B642xBPsgXs/5G7EbvwOBL6cyMDDY5R5Cy5BPA5v4oAx1ng5flTmZHobY= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:from:to:cc:references:subject:date:message-id:mime-version:content-type:content-transfer-encoding:x-mailer:thread-index:in-reply-to:x-mimeole; b=JGQeuynqcqzXjepuqDOnLluRs6f4KNxSa9+tS1xaWlq6wXUjRu/mKQ5sddmXyfiMd0GP4UPH1Whdm/eE2UGaHNENQWXI9V1zEO0xSkgIIEkMiZ2/2G5e9qR0+nCmtaIc2WB4ag7odCOtJPh8sZ2+PE08ajyiOdjLf+kS2y/xxYA= Thread-index: AcfV+Z674J0rc+qJTKKfpjncFqL+0QAmkzZQ On Aug 3, 2007, at 10:07 AM, Vishal Shetye wrote: > after going through several links like kauth (http://developer.apple.com/technotes/tn2005/tn2127.html > ), > KauthORama source, mac osx internals by amit singh, http://developer.apple.com/documentation/Darwin/Conceptual/KernelProgramming > and many mailing list discussions I find myself really confused. > > My simple question is, with currently supported kpis is virus-scan > application really feasible? > It requires hooking of system calls, use kauth vnode scope, so far > so good. But opening file for virus scan (low level open), denying > access, such functions deal with file system structures. No, they don't. They deal with you: (1) Exempting your virus scan daemon from such checks when it makes requests, by having it register its process with your KEXT (2) Your KEXT hooking the kauth hooks you are interested in, sending a message to user space, doing your work there (including calling back into the kernel and getting a "free pass""on scanining before the scanner is allowed to open the file) (3) You sending the result back to the KEXT as to whether the action should be allowed or denied (4) Your KEXT allowing/denying the kauth operation that started this chain of events. -- Terry This is something nobody should miss before designing. Actually I intend to hook open system call and scope suitable for me is VNODE. Although KAUTH_VNODE_READ_DATA suffice the purpose, how would I differentiate between open and read. And what about close()? What notification should I receive? _______________________________ - vishal shetye _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: virus scan application
by Terry Lambert 03 Aug '07

03 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com No, they don't. They deal with you: -- Terry _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… On Aug 3, 2007, at 10:07 AM, Vishal Shetye wrote: after going through several links like kauth (http://developer.apple.com/technotes/tn2005/tn2127.html ), KauthORama source, mac osx internals by amit singh, http://developer.apple.com/documentation/Darwin/Conceptual/KernelProgramming and many mailing list discussions I find myself really confused. My simple question is, with currently supported kpis is virus-scan application really feasible? It requires hooking of system calls, use kauth vnode scope, so far so good. But opening file for virus scan (low level open), denying access, such functions deal with file system structures. (1) Exempting your virus scan daemon from such checks when it makes requests, by having it register its process with your KEXT (2) Your KEXT hooking the kauth hooks you are interested in, sending a message to user space, doing your work there (including calling back into the kernel and getting a "free pass""on scanining before the scanner is allowed to open the file) (3) You sending the result back to the KEXT as to whether the action should be allowed or denied (4) Your KEXT allowing/denying the kauth operation that started this chain of events. This email sent to site_archiver(a)lists.apple.com

1 0

virus scan application
by Vishal Shetye 03 Aug '07

03 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:from:to:subject:date:message-id:mime-version:content-type:x-mailer:x-mimeole:thread-index; b=UlShwz1QeRdasF/dIs4wdcj+9sVAQZ0I5FBgo0D98YSPPQ+70r1rIHCxJABPtkfKGm6QRlXc0o/BrEWjIcM9pOIbWCg0j+8DFBSUerNChQ2HrKgsf5sq5dtPuIR8y6Y8o2MjHEziLCzhNGKcrKhJqMvD/cwvqs7UXNLw/I0/qaE= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:from:to:subject:date:message-id:mime-version:content-type:x-mailer:x-mimeole:thread-index; b=lSSsJwbCxxGq0UErtdcSTUGssk+h5rMvtvHkZGKIQo5eZ2RuGcS+xXY+WxjXvmsDjPDSXjqcfaGIKftTIZNVJdjPIKMHw1o1tpeGaJ81KEKsEwtg3Q0BkPiCnclqaXQ4zdqZpyTYUWLQkWyafja7zJBKlInpmlkSMz4G9xEpRvA= Thread-index: AcfV8NEBB8aGNnalSWG4I2xZ6tCfGg== _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: NASM __i686.get_pc_thunk
by mm w 02 Aug '07

02 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:message-id:date:from:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition; b=qEjZszouXj6v6Fa7dKDSGHONzmHdwfY7862nKmQcTa/5y2fT9EnEmeVQvbYFbdIFk4Pnv0oR6DrGSCUa1RyCbRxlpcXf78wI+UABsbtxrReW0XYxJbtZ8YrsfQLj5+25nR5n9S+Bdedl+iGADcknbMerlGMxWtJToSefN/bzUdQ= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:message-id:date:from:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition; b=eAxhxdud8PsQg7IsjqGAc+WESOD0pPYuel+gbfZX7ieVr5S3eeUDC2XS0NpPjP5alGJdMfwJSmGV6jZ3RAIiRXaU84VEwSM40JXfDza7iye6b1YD4Reqybyq5PdJNgLPhgXWaxetn+HmV6RAXI727sRV9F9MQ3OxL1FEM6vNqVM= Hi Mike, my previous comment was not about syscalls or some difficulties to use nasm nor assembler (i still know what i do :) ) my only interest was the mach-o file structure produced by nasm tool , (for a simple example simplier as possible ), in comparison to gcc output ecetera , ( you missed a lupus) anyway just shoot me :) + _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: NASM __i686.get_pc_thunk
by mm w 02 Aug '07

02 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=ZPAFOC9qbvMxH8fjyYE57P3iOGXucg21zSxopaJLXGsD01iz/oxYCwuMi7zVH3cJifXHRmho7OowPFehKg89NJpShJhedHf1RWisNjx9Ve5REwh4OSWYHaOHRQ2uGt3aMvybjwioQSH1UK7wAJ/P+/fLO+TYL2nuCvquUOB/8eg= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=ohaV8/WebYP/fjVDbUy1tvc66aYs+BICUOFNqdnc7PCwKkYH8I9FGIijSugSlgX1xi3yffzZewHJIkYQY2c3BAYxERR9WztoJOPZtXnEwGq5GVnPPcTjvHUocBLbIu54ZD8qsZEDogmygbJaD6osR6nfD2Pgd90qK+l81q4Fm6g= L_foo$lazy_ptr + On 8/2/07, Michael Smith <drivers(a)mu.org> wrote: > > On Aug 2, 2007, at 8:28 AM, mm w wrote: > > > sorry, > > it was really difficult to find, but i finally found what i needed > > to know :) > > nasm sucks :D > > > > mov ebx,0 > > mov eax,1 > > int 0x80 > > If what you mean is "I have found out how to make system calls", then > I would point out that the ABI offered to user programs under Darwin > is at the interface to the system-supplied frameworks. > > System calls, their numbering, arguments and semantics are subject to > change at any time, and any assumptions you make about them are > intrinsically invalid. > > = Mike > > > > _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: NASM __i686.get_pc_thunk
by Michael Smith 02 Aug '07

02 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Aug 2, 2007, at 8:28 AM, mm w wrote: mov ebx,0 mov eax,1 int 0x80 = Mike _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… sorry, it was really difficult to find, but i finally found what i needed to know :) nasm sucks :D If what you mean is "I have found out how to make system calls", then I would point out that the ABI offered to user programs under Darwin is at the interface to the system-supplied frameworks. System calls, their numbering, arguments and semantics are subject to change at any time, and any assumptions you make about them are intrinsically invalid. This email sent to site_archiver(a)lists.apple.com

1 0

Re: NASM __i686.get_pc_thunk
by mm w 02 Aug '07

02 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:message-id:date:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=cij4mzAM+Wlz34CZXMUGn/2BatNeS8DubG+TgR+luNx+gJVD8za0FnuBPzma7koLGmySLSDttg8OjXtGYkjvgQMRcGGm1tE1WvwfYrSkQOhfYvCfhX3FWnBcr7fYfOqc+yYDSFgYMi+ewE9jOgeof9RJz5Gc0bWkqYOB+vQOioQ= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:message-id:date:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references; b=XfuNpa3jCqvucPReyCswjxwozYBXU/C/p8l5ZbOacjwYYykD42xtK0r81PlIuNUYiTkgZfkyUwzBxyTMZIeXtD9N6poYipYYAq24JLsUy+UTPd65tvGPBpQWQqt3LF2l/PTh9v/maZ9n3auPgBR9eKp4mOzVn1W10yGQu01QnHI= sorry, it was really difficult to find, but i finally found what i needed to know :) nasm sucks :D mov ebx,0 mov eax,1 int 0x80 + (je sors) On 8/2/07, mm w <openspecies(a)gmail.com> wrote: > -------------------- lp.asm -------------------- > global _main > extern _printf > > section .text > _main: > push say > call _printf > add esp, 4 > ret > say: > db 'Lupus Magnus', 10, 0 > > -------------------- lp.asm -------------------- > > ---------------------------------------------------- > $> nasm -f macho -o lp_nasm.o lp.asm > $> nm lp_nasm.o > 00000000 T _main > U _printf > 00000011 t say > ---------------------------------------------------- > > did i miss something ? > > + > _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

NASM __i686.get_pc_thunk
by mm w 02 Aug '07

02 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:message-id:date:from:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition; b=RKt4qx8DIELOqu8omcAFqQDNJ+bMdGgNe6BiIfRkVulnrGdotOfF/B7P7hDhGccxpNxtp2K/meQbOoVlqlwMR6yc2GUiSaXxSqqmsCb08pOo9rmCEzoaoTgTyh6IfJwzpVILI6DQ6F86InITw5GKk/huaoUVdDPVV/SeEl0itXE= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:message-id:date:from:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition; b=rW2sGeMQOae65L9apN8mViq42vZ8P6TRJ97nFdYDJY231GekNEhRbq/ToN0UnKvLGy9uucChNIZW+6+mOE9wr8e2e3X1Y1qjjhfKdOHUq0FMc+kPXeFAKdumPoW4IrnzQH8eDAUu5tMEeTbih+0u4eWQYRqt8/FBbeV8JfXGtr8= -------------------- lp.asm -------------------- global _main extern _printf section .text _main: push say call _printf add esp, 4 ret say: db 'Lupus Magnus', 10, 0 -------------------- lp.asm -------------------- ---------------------------------------------------- $> nasm -f macho -o lp_nasm.o lp.asm $> nm lp_nasm.o 00000000 T _main U _printf 00000011 t say ---------------------------------------------------- did i miss something ? + _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Debug symbols for latest 10.4.10?
by Garth Cummings 01 Aug '07

01 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Headers for kext
by Quinn 01 Aug '07

01 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com -- _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0