[Search for users] [Overall Top Noters] [List of all Conferences] [Download this site]

Conference noted::hackers_v1

Title:	-={ H A C K E R S }=-
Notice:	Write locked - see NOTED::HACKERS
Moderator:	DIEHRD::MORRIS

Created:	Thu Feb 20 1986
Last Modified:	Mon Aug 03 1992
Last Successful Update:	Fri Jun 06 1997
Number of topics:	680
Total number of notes:	5456

46.0. "using installed images ..." by WEBSTR::STUART () Wed Aug 15 1984 17:04

i had an experience at school recently that some may get a chuckle out of.

i was hired by my school's computer center (colgate university for those who've heard of it ... no network, and a director who's not likely to get on one, but
what can you do?) to write variouas small utilities, one of which was a
temporary EXQUOTA privilege enabler. the idea was that if you were under quota
when you ran it, it would insert the EXQUOTA bit in your process priv mask.
no big challenge ... it was eventually installed with CMKRNL priv, and was
given no further though. well, a friend of mine discovered it while hacking
about, and presented me with a debugger log file of my code, asking me if
i recognized it. i did (of course), and looking at the debugger log file,
realized that if it could be run in the debugger, one could employ the
various features of the debugger to get privs. it was all too easy ... run it
/DEBUG, wait until right before the proc priv mask was written, and deposit
'FFFFFFFF' into the appropriate location, and you had all privs while you
were logged in.

we also toyed with the idea of PATCHing installed images ... anyone have
any thoughts?

					et

T.R	Title	User	Personal Name	Date	Lines
46.1		GLIVET::DIAMOND		`Wed Aug 15 1984 18:44`	6
	No way. You shouldn't be able to run an installed image with the debugger! When you patch, you create a new image file and the old one remains installed. To have privs in the new patched one, you'd have to re-install it. I don't see how you even got the one with the debugger to work... dave
46.2		ORPHAN::BRETT		`Wed Aug 15 1984 21:52`	12
	Privileged images SHOULD be linked /NODEBUG/NOTRACE. Failure to do this leads to the aforementioned hole. Unfortunately an earlier release of VMS had DISPLAY (precursor to MONITOR) with this bug. The real big thing to watch with privileged images is the affect logical names can have on your program. /Bevin
46.3		VAXUUM::DYER		`Thu Aug 16 1984 19:03`	3
	I believe VMS V4 will not let you install an image that was linked /DEBUG or /TRACE. <_Jym_>
46.4		GLIVET::DIAMOND		`Fri Aug 17 1984 09:06`	4
	Well, by golly you're right. I just tried a debugged program with install and it worked... dave
46.5		ROYCE::KENNEDY		`Wed Aug 22 1984 11:40`	19
	YOU DON'T NEED TO LINK TO THE DEBUGGER TO USE IT ================================================ Some time ago, I was called in to look at a third party package (INFO) from a firm called HENCO. The package worked OK under the normal terminal driver but failed under the NV: driver (X25 remote terminal). I hacked at the package using RUN/DEBUG and lo and behold - I was in the debugger! Soon enough, I was able to locate an illegal terminal function code which was not being picked up by TT: but was by NV:. There was no trace-back info, just a raw image, a dissassembling debugger and the promise of a Pint if I fixed it. Another interesting little point is that if you call LIB$SIGNAL with a status code of SS$_DEBUG, you end up in the debugger ( I havn't checked this yet). By using this together with assignments of DBG$INPUT and DBG$OUTPUT, this could be a neat way of debugging detached processes. Hugh.
46.6		ROYCE::KENNEDY		`Wed Aug 22 1984 15:39`	10
	Quick postscript to the previous reply - it is /NOTRACEBACK that prevents the debugger from comming in when you say RUN/DEBUG. Unfortunately /TRACEBACK is invaluable for getting information out of crashed programs, especially in Field Test software. If the comment about V4 INSTALL is correct then this potential hole will go. Pity - It could have been quite useful! hugh.
46.7		GLIVET::DIAMOND		`Wed Aug 22 1984 11:32`	4
	Useful for whom? The only people who need to hack around like that are people who probably shouldn't be! Dave
46.8	Debugger fun in VMS V2	MDVAX3::COAR	And your little dog, 2!	`Fri Oct 09 1987 22:28`	11
	I remember using the debugger on a normal, unprivileged, program from a normal, unprivileged, account. The system manager was walking by, and I showed her what happened if I did a DEPOSIT PSL=0 - the formatted values displayed by EXAMINE PSL showed me to be in kernel mode, and to have always been that way (as far as VMS was concerned). She nearly had a coronary on the spot; I had to take pity on her and show her that it was the STORED PSL I was munging, not the active one, and that VMS would crap on the debugger if it tried to restore the altered PSL value. #ken :-)}