nohup vs &

reference

http://stackoverflow.com/questions/21294283/when-did-hup-stop-getting-sent-and-what-can-i-do-about-it

http://stackoverflow.com/questions/4298741/how-bash-handles-the-jobs-when-logout

http://stackoverflow.com/questions/15595374/whats-the-difference-between-nohup-and-ampersand

http://www.astro.washington.edu/users/sjschmidt/premap/linux/processes.html

LKM syscall links

http://commons.oreilly.com/wiki/index.php/Network_Security_Tools/Modifying_and_Hacking_Security_Tools/Fun_with_Linux_Kernel_Modules

http://asm.sourceforge.net/syscall.html#1

http://crashcourse.ca/introduction-linux-kernel-programming/lesson-17-your-first-character-device-driver

http://syprog.blogspot.co.il/2011/10/hijack-linux-system-calls-part-iii.html

https://www.thc.org/papers/LKM_HACKING.html#II.1.

http://www.hackercurriculum.org/linux-rootkits

http://tuxthink.blogspot.co.il/2010/11/writing-example-driver-from-scratch.html

http://crashcourse.ca/introduction-linux-kernel-programming/lesson-16-lets-talk-about-devices

https://books.google.co.il/books?id=96V4AgAAQBAJ&pg=PA274&dq=nf_hook_ops&hl=en&sa=X&ei=8WBhVYLmEYr3UoC3gLAM&ved=0CBwQ6AEwAA#v=onepage&q=nf_hook_ops&f=false

https://gcc.gnu.org/onlinedocs/cpp/Macros.html#Macros

http://www.linuxjournal.com/article/7184

http://lxr.free-electrons.com/

http://kevinboone.net/linuxfile.html

http://webcourse.cs.technion.ac.il/230349/Winter2014-2015/en/ho_Slides.html

copy file with ssh without scp

text file

cat /tmp/aaa | ssh user@host "cat - > aaa"

ssh user@host cat < /tmp/aaa ">" aaaa

from remote to local

ssh user@host cat > /tmp/bbb "<" bbb

uuencode - encode a binary file

 -m     Encode  the  output using the MIME Base64

http://www.commandlinefu.com/commands/view/4408/copy-a-file-over-ssh-without-scp

GDB cross compiler

objective

• compile gdb static for mips /el

pre

• create build and source folders
• download gdb 7.9 and termcap 1.3.1 to source folder
• create cross compiler with buildroot or crosstool-ng (i used buildroot)

termcap

under build folder create sub folder 

(host)$mkdir -p build/termcap/mipsel

(host)$export CC=<path>/buildroot/output/mipsel/host/usr/bin/mipsel-linux-gcc

(host)$./configure --host=mipsel-linux --prefix='/<path>/build/termcap/mipsel/'

(host)$make

(host)$make install

gdb 7.9

(host)set PATH=/to/gcc/folder

(host)$cd to gdb-7.9 folder #don't run process from gdb subfolder see README

(host)$export CC=<path>/buildroot/output/mipsel/host/usr/bin/mipsel-linux-gcc

#set ld flags: static and point to termcap lib folder

(host)$export LDFLAGS="-static -L/<path>/build/termcap/mipsel/lib"

#set include to termcap include folder

(host)$export CFLAGS="-g -O2 -I/<path>/build/termcap/mipsel/include"

(host)$./configure --host=mipsel-linux --prefix='/<path>/build/gdb_mipsel' --disable-werror

(host)$make

(host)$make install

Note

host: compiler prefix

reference

http://tigertop.blogspot.co.il/2011/03/building-gdb-72-for-arm-architecture-on.html

first mips assembly

LAB

objective

• compile mips assembly with gcc
• run in emulation

setup

• gcc: aboriginal cross compiler , mipsel
• emulator: qemu-user-static

sudo apt-get install qemu-user-static

vim exit.S

#include <sys/regdef.h>

#include <asm/unistd.h>

.data

.text

.global main

main:

        .set noreorder

        .cpload t9

        .set reorder

        li a0, 99

        li v0, __NR_exit

        syscall

note: file ext must be capital S

compile

include cross gcc in path or point run directly

$mipsel-gcc -o exit exit.S

run

copy qemu to chroot folder

$cp $(which qemu-mipsel-static) .

$sudo chroot . ./qemu-mipsel-static ./exit

/lib/ld-uClibc.so.0: No such file or directory

we get error because we compile dynamicly and the lib folder not include in chroot folder

we need to bind the lib folder for outside the chroot to chroot location

$mkdir lib

$sudo mount --bind <path/to/cross_compile/lib> lib

$sudo chroot . ./qemu-mipsel-static ./exit

checking

echo $?

99 # the return value for exit syscall

tcpdump

https://danielmiessler.com/study/tcpdump/

mips assembly

Instructions

all instruction are 32 bit long

instruction fall into three categories:

R-type: register type instructions

I-type: immediate 

J-type: jump instructions

jump

There are the list of instructions we'll look at.

• beq Branches if the quantities of two registers are equal.
• bne Branches if the quantities of two registers are NOT equal.
• bgtz Branches if a quantity in a register is greater than zero (quantity is 32 bit, 2C).
• bgez Branches if a quantity in a register is greater than or equal to zero (quantity is 32 bit, 2C).
• bltz Branches if a quantity in a register is less than zero (quantity is 32 bit, 2C).
• blez Branches if a quantity in a register is less than or equal to zero (quantity is 32 bit, 2C).
• j Jump to an address
• jr Jump to an address stored in a register
• jal Jump to an address, and store the return address in a register.
• jalr Jump to an address stored in a register, and store the return address in another register.

http://www.cs.umd.edu/class/sum2003/cmsc311/Notes/

IDA Python

debug

pycharm pro

• copy pycharm-debug.egg from /path/to/pycharm/debug-eggs to remote computer if nessery
• add code to IDA python script

import sys
import os
current_path = os.path.dirname(__file__)
egg_loc = os.path.join(current_path, "pycharm-debug.egg")
sys.path.append(egg_loc)
print egg_loc
import pydevd
pydevd.settrace("host ip/name", port=12345, stdoutToServer=True, stderrToServer=True)

• config pycharm (Run/Debug Configuration)

add Python Remote Debug

• Run Debug server

References

https://www.hex-rays.com/products/ida/support/idapython_docs/

http://www.slideshare.net/geeksec80/introduction-to-ida-python

http://reverseengineering.stackexchange.com/questions/2190/how-to-debug-an-idapython-script-from-within-ida/2885#2885

http://www.offensivecomputing.net/papers/IDAPythonIntro.pdf

http://www.slideshare.net/geeksec80/python-arsenal-for-re-1?related=1

PyCharm remote debug

PyCharm Professional only (community with remote server)

1)

Run/Debug Configuration

config server address and port listen

2)

copy debug-eggs to remote computer

locate /path/to/pycharm/debug-eggs

3)

add attach code to code under debug

4)run server

Buildroot "output" directory for multiple targets

 mkdir device

cd device

  make -C "/path/to/buildroot" O="`pwd`" menuconfig

  make

qemu compile

ubuntu 14.04

apt-get install libglib2.0-dev zlib1g-dev

./configure --disable-kvm 

--target-list="mips-linux-user"

make

make install

run qemu

from squash root folder

qemu-mips -L . -strace path/to/app

qemu-mips -L . -strace usr/sbin/miniupnpd