Big news involving kernel modules (info inside) - Verizon Galaxy Note 3 General

Great news!
Developer jeboo from over at the Verizon S4 forum was successfully able to insert a modified stock kernel module without issue on MK2 (an older S4 build, but with Knox.)
What does this mean? Well, for one, it means that there is a possibility of kexec (custom kernels), but certain things need to be accomplished first. We need to figure out if we can exploit modified modules, as opposed to inserting a new module (which I'm not sure has been attempted yet using the put/get user exploit.) Jeboo is posting the code on github for developers out there. He is going to try on MJ7 next, as he has only attempted MK2 so far. The exploit was patched in October/November I believe, so there is a possibility MJ7 and MJE may be vulnerable. I will post the link for his github when it becomes available. Keep in mind there's much more we can accomplish besides kexec with kernel modules also.
Source: Here

---

Oh now that would be totally awesome the only thing I'm really missing is a fast charge kernel that would really solve the last of my problems.
ryanbg said:
Great news!
Developer jeboo from over at the Verizon S4 forum was successfully able to insert a modified stock kernel module without issue on MK2 (an older S4 build, but with Knox.)
What does this mean? Well, for one, it means that there is a possibility of kexec (custom kernels), but certain things need to be accomplished first. We need to figure out if we can exploit modified modules, as opposed to inserting a new module (which I'm not sure has been attempted yet using the put/get user exploit.) Jeboo is posting the code on github for developers out there. He is going to try on MJ7 next, as he has only attempted MK2 so far. The exploit was patched in October/November I believe, so there is a possibility MJ7 and MJE may be vulnerable. I will post the link for his github when it becomes available. Keep in mind there's much more we can accomplish besides kexec with kernel modules also.
Source: Here
Click to expand...
Click to collapse

---

Awesome news!! A lot of doors can be opened with that.
Sent from my SM-N900V using Tapatalk

---

I loved custom kernels on the Note 2 since they could be overclocked and had a lot of other useful features.
I had been wondering why the Note 3 didn't have any custom kernels, yet did have other custom ROMs.

---

http://forum.xda-developers.com/showthread.php?t=2578566
Sent from my SM-N900V using Tapatalk

---

Sweet
Sent from my SM-N900V using Tapatalk

---

This is good news.
Sent from my SM-N900V using Tapatalk

---

I don't mean to be the debby downer but... This is irrelevant, because kernel modules are disabled completely in the note 3. @ryanbg
Sent from my SM-N900V using Tapatalk

---

Brandonrz said:
I don't mean to be the debby downer but... This is irrelevant, because kernel modules are disabled completely in the note 3. @ryanbg
Sent from my SM-N900V using Tapatalk
Click to expand...
Click to collapse
Hashcode stated he was looking into this... Who knows what will come from this

---

2swizzle said:
Hashcode stated he was looking into this... Who knows what will come from this
Click to expand...
Click to collapse
Absolutely nothing, the only thing you can do is enter kernel modules and still be able to flash; wich leaves a possibility for a kexec module could be inserted. Our kernel disables kernel modules, so no possibly for a kexec module to be inserted. And even if there was something the get/put exploit could do for us, chances are It was patched most likely on mje, or mj7. He said he'll see what he can do with this, he was talking about the s4. Even ask @Hashcode himself.
Sent from my SM-N900V using Tapatalk

---

Brandonrz said:
Absolutely nothing, the only thing you can do is enter kernel modules and still be able to flash; wich leaves a possibility for a kexec module could be inserted. Our kernel disables kernel modules, so no possibly for a kexec module to be inserted. And even if there was something the get/put exploit could do for us, chances are It was patched most likely on mje, or mj7. He said he'll see what he can do with this, he was talking about the s4. Even ask @Hashcode himself.
Sent from my SM-N900V using Tapatalk
Click to expand...
Click to collapse
You can modify stock kernel modules without triggering signature verification, which makes inserting a new module redundant, at least for our purpose. MJE and prior kernels are most likely not patched as it was compiled on Nov. 11. The S4 and Note 3 are almost identical, so this is likely reproducible. I am sending an MJE boot.img to jeboo to take a look at. You should take a look at his code on github. He also tested this successfully on MJ7 for S4.
"The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain addresses, which allows attackers to read or modify the contents of arbitrary kernel memory locations via a crafted application, as exploited in the wild against Android devices in October and November 2013."
From CVE-2013-6282
Verizon MJE Note 3 kernel was compiled on November 11th.
This is the exploit that jeboo is using. Here
I tested inserting a modified stock module and one I compiled. Btw, if you wanna use the modules from the kernel source tree, be sure to add
Click to expand...
Click to collapse
by jeboo from his exploit thread.
It's also important to note that if this does have any success on our device, it would be advisable to not update.

---

ryanbg said:
You can modify stock kernel modules without triggering signature verification, which makes inserting a new module redundant, at least for our purpose. MJE and prior kernels are most likely not patched as it was compiled on Nov. 11. The S4 and Note 3 are almost identical, so this is likely reproducible. I am sending an MJE boot.img to jeboo to take a look at. You should take a look at his code on github. He also tested this successfully on MJ7 for S4.
"The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain addresses, which allows attackers to read or modify the contents of arbitrary kernel memory locations via a crafted application, as exploited in the wild against Android devices in October and November 2013."
From CVE-2013-6282
Verizon MJE Note 3 kernel was compiled on November 11th.
This is the exploit that jeboo is using. Here
by jeboo from his exploit thread.
It's also important to note that if this does have any success on our device, it would be advisable to not update.
Click to expand...
Click to collapse
This is indeed great news. A lot of amazing devs out there! Unfortunately for me i sold my note 3 and the dev edition is back ordered :/

---

If I fire up a terminal the modprobe and insmod commands are both there. @Brandonrz was saying that our kernel disables kernel modules, but why then are those commands available?
I am still on MI9 and I took an MI9 boot.img, extracted its contents and loaded the zImage file into IDA but I am in unfamiliar territory here. I searched for strings with "auth" in them and didn't see anything with lkmauth. Maybe that's because loadable kernel modules are, as @Brandonrz was saying, disabled. Obviously someone with more experience and knowledge of IDA would be beneficial here.
I'm at work now, but I plan on writing a simple kernel module to try and load it using modprobe to see what kind of output I get.
I know this isn't much, but thought I would at least contribute. Please don't get any false hope from this post, not much here.

---

I know this isn't much, but thought I would at least contribute. Please don't get any false hope from this post, not much here.[/QUOTE]
Iregardless, lol, thanks for keeping up with the fight!
Sent from my SM-N900V using Tapatalk

---

OK, to follow up to my previous post...I built a simple module and tried to load it using insmod which fired off an error about Function not implemented. So modules are definitely disabled for our kernel (turns out there's a much easier way to tell this, ::facepalm:: ). I guess insmod and modprobe are included despite the kernel config being set to not support modules. Sorry, I know this is repeat info for more experienced devs.
I'm going to leave this one alone, but I'm interested to learn more about the process as jeboo and other devs work on the GS4 solution.

---

lkspencer said:
OK, to follow up to my previous post...I built a simple module and tried to load it using insmod which fired off an error about Function not implemented. So modules are definitely disabled for our kernel (turns out there's a much easier way to tell this, ::facepalm:: ). I guess insmod and modprobe are included despite the kernel config being set to not support modules. Sorry, I know this is repeat info for more experienced devs.
I'm going to leave this one alone, but I'm interested to learn more about the process as jeboo and other devs work on the GS4 solution.
Click to expand...
Click to collapse
I didn't want to say anything but... Sorry, I want it as much as anyone else.
Sent from my SM-N900V using Tapatalk

---

MJE kernel patched the exploit for you guys, sorry and im not just saying that, I know this from personally looking at the kernel source and the patch for the exploit. I tried forever to get you guys saferoot. The interesting thing is that kingo still gets root for you guys with an as of yet undiscovered exploit..
Sent from my SCH-I545 using XDA Premium 4 mobile app

---

Brandonrz said:
I didn't want to say anything but... Sorry, I want it as much as anyone else.
Sent from my SM-N900V using Tapatalk
Click to expand...
Click to collapse
That's ok, it was a good learning experience for me. I've got quite a bit to learn for this stuff. I'm a developer by trade, but this is a different ball field for me.
---------- Post added at 08:59 AM ---------- Previous post was at 08:48 AM ----------
Surge1223 said:
MJE kernel patched the exploit for you guys, sorry and im not just saying that, I know this from personally looking at the kernel source and the patch for the exploit. I tried forever to get you guys saferoot. The interesting thing is that kingo still gets root for you guys with an as of yet undiscovered exploit..
Sent from my SCH-I545 using XDA Premium 4 mobile app
Click to expand...
Click to collapse
So since I am still on MI9 I can still use this exploit right? Is it possible to use it to make some kind of rootkit? I don't know to what end, just asking to learn.

---

lkspencer said:
That's ok, it was a good learning experience for me. I've got quite a bit to learn for this stuff. I'm a developer by trade, but this is a different ball field for me.
---------- Post added at 08:59 AM ---------- Previous post was at 08:48 AM ----------
So since I am still on MI9 I can still use this exploit right? Is it possible to use it to make some kind of rootkit? I don't know to what end, just asking to learn.
Click to expand...
Click to collapse
Honestly I dont know if it was MJE. It was whatever was the latest Samsung open source kernel they released at the time. We tested on the dev MJ3 kernel as well and that didnt work. But you have to edit the source with your kernels info. Id say if your output from cat /proc/version is early Oct or before then maybe.