Operating System Boot Process

Boot Process

• BIOS (Basic Input/Output System) or UEFI (Unified Extensible Firmware Interface) are stored in ROM
• BIOS/UEFI initializes hardware: CPU, RAM, Storage
• BIOS/UEFI ensures hardware functions correctly using POST (Power-On Self-Test)
• BIOS/UEFI looks for a bootable device
• Bootloader (usually GRUB) is a small program that loads the OS into memory
• GRUB loads the kernel from /boot and initializes it into memory
• Kernel initializes memory management, processes, and devices
• The first user-space process, systemd, is started
• Systemd manages system services and daemons
• Systemd reads config files to launch services, mount filesystems, and set up the user environment
• Mount the root filesystem, then start system services based on the default target
• Startup scripts are executed

Monolithic Kernel

• The OS is a Monolithic Kernel
• User Space contains Applications
• Kernel Space contains: VFS, System call, IPC, File System, Scheduler, Virtual Memory, Device Drivers, Dispatcher, and Hardware

Lab 0x00: Know Your Machine

• Use i3 or sway
• Use Alacritty, oh-my-zsh, vim, and other tools
• Navigate into your file system

Linux File Structure

• Key concepts are Linux File Hierarchy, File descriptor (fd), Task/threads/Process, and Uid/Permissions
• Everything is treated as a file
• Seven file types exist: regular, directory, link, character device, block device, fifo, and socket
• New entries appear in the open file descriptor table using functions like: open, openat, create, open2
• File descriptors can be copied using: dup, dup2, fcntl.

Core Structs

• Every process has a per-thread struct task_struct
• This struct has a pointer to files_struct, containing an array of pointers to file structs
• Files_struct contains file flags and current position information
• Entries across running threads constitute the open file descriptor table

Virtual Function Table

• Achieves genericity
• Composed of function pointers
• A well-known Virtual Function Table is struct file_operations
• Since everything is a file but of different types, operations, often called f_ops, differ
• This allows kernel code to handle files independently by their type, promoting code factorization

Credentials (creds)

• Includes user ID, group ID, capabilities, and security information

File Permissions

• Permissions are represented by read (r), write (w), and execute (x), with numerical values of 4, 2, and 1 respectively

Lab 0x01: Linux Kernel Env

• Download Linux and Busybox
• Compile both
• Create your file hierarchy
• Emulate with QEMU!

Linux Kernel

• Process Management allocates CPU time, manages process states, and handles synchronization
• Memory Management handles system memory, implementing virtual memory
• File System Management provides a file system interface, managing file access permissions
• Device Drivers enable communication between the OS and hardware

CPU vs GPU

• CPU executes instructions, manages operating system processes, and handles system-level processes
• GPU accelerates graphics rendering and has evolved into a highly parallel processor for large data amounts
• GPUs Excel at parallelizable tasks like rendering graphics and processing images
• Both CPUs and GPUs have different protection mechanisms, which can lead to interesting exploitation opportunities

Kernel Modules

• Allow functionality to be added to or removed from the kernel
• Two types: Loadable Kernel Modules (LKMs) and Built-in Kernel modules
• Use Insmod to insert a module and rmmod to remove a module
• /dev contains device files representing hardware devices

init and exit

• module_init and module_exit are used in kernel modules
• File_operations (fops) contains pointers to functions that implement operations on files and devices
• Supported system calls: Open, Release, Write, Read, and ioctl

User space

• Functions to handle copying from and to user space: Copy_to_user / Copy_from_user
• Functions to manage memory: Kmalloc / kfree, memcpy and Printk

Lab 0x02: Dev LKM

• Develop a Linux Kernel Module and interact with it through a user script
• Main tasks: Implement Read/write operations, IOCTLs, use Kmalloc/kfree, and analyze the binary in IDA