LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Non-*NIX Forums > Programming
User Name
Password
Programming This forum is for all programming questions.
The question does not have to be directly related to Linux and any language is fair game.

Notices


Reply
  Search this Thread
Old 03-13-2005, 11:20 PM   #1
McDe
LQ Newbie
 
Registered: Mar 2005
Location: near Earth
Distribution: Slackware
Posts: 6

Rep: Reputation: 0
userland memory to Ring 0 for boothing up linux


Booting Linux from ohter Operating Systems (with out multi/rebooting)

Back around 5 years ago (or more?) they had an OS called BeOS.
It ran on nost things, PPC,OldMac,x68,etc,etc...
But they had a bigger trick.. it allowed an installation of a
BeOS shortcut to OTHER Operating systems.

I'm NOT talking about emulation, userland linux or
multi boot...

eg) in windows, double click and execute this link, and somehow,
the program takes over the cpu, along with address
of aready loaded drivers, and boots the BeOS, taking total controll
over the system...and even using drivers of other OS's...

The consept is, you have a application, that starts from userland memory.
It gains (through loopholes in the other OS's) enough privilidge
to acsess rong 0 of the CPU, and gets address of the BeOS
and (probably) loads OS bootloder into memory, and WOW.
It loads the BeOS...

Thecnicay it is S.I.C.K. but it is possible...
The nutty peple(with full compliment) in BeOS team has shown it
(It was called BeLoader)

Only problem is...It wasn't open sorse at the time...

I am currently stuck, where this might be the only way for
booting / inplimenting linux...

Reverse Engeneering of the full boot sequence code in asm
has failed, looks like someone was on CAT while they wrote this
spagetty code...

Is any one out there to know the technical details of the great work???

Would be an extra trick up the sleeve for Linux if it can be loaded
from an shortcut in windows desktop (and taking over windows)

hehe. SeeYa!
 
Old 03-14-2005, 12:45 AM   #2
btmiller
Senior Member
 
Registered: May 2004
Location: In the DC 'burbs
Distribution: Arch, Scientific Linux, Debian, Ubuntu
Posts: 4,290

Rep: Reputation: 378Reputation: 378Reputation: 378Reputation: 378
There's a program called Loadlin that will boot Linux from DOS, you might want to take a look at it. If I had to guess about this, I would guess that the BeLoader did that by using some of the hooks in Windows that allowed old DOS programs to run ... I could be completely wrong on that, though. It would be interesting to know.
 
Old 03-14-2005, 02:51 AM   #3
McDe
LQ Newbie
 
Registered: Mar 2005
Location: near Earth
Distribution: Slackware
Posts: 6

Original Poster
Rep: Reputation: 0
Yep, I've aready looked into that...Thanks anyway :)
There is also a patch to allow it be used from windows(9X),
but It's done by terminating windows beforehand,
so there's nothing new there.

Furthermore, I could get the sourse code, but development
has halted somewhere around 1998 or 1999 from my memories.
and It's unlikely they will bring a update for current OS's.

What BeOS did was kind of a 10point trick at the time(94'),
we could probably call it torjan/stealth virus kind of thing these days since the program forces it self to higher privilidge.

some sites (eg- phrack.org) seems to still manage to
publish methods of getting into ring 0 from userland,on the Windows NT(inc Xp/2000) series kernel.

(various artics focus on getting back to windows safely, with out getting detected, but none for a positive use YET...)
I have not seeen anyone go from there to managing a kernel boot...

WindowsM$ dosen't like these articles published, so resourse is scare at the moment.

The most important point is, (assuming I can work out the
entry and types ) I could load data/drivers from the previous OS.
(On PPC(mac), Be managed to operate more devices then from booting up cold... :p)

The 2.6 kernel implimented new memory managenent,
so it should be worth a shot, dinamically hijacking the
windows memory structure.

WinXP-start->AllPrograms->HijackToLinux2.6
Wouldn't you want to try It... I would...

greets.
McDe

Last edited by McDe; 03-14-2005 at 02:54 AM.
 
Old 03-14-2005, 08:41 AM   #4
gnashley
Amigo developer
 
Registered: Dec 2003
Location: Germany
Distribution: Slackware
Posts: 4,928

Rep: Reputation: 613Reputation: 613Reputation: 613Reputation: 613Reputation: 613Reputation: 613
loadlin does what you want.
see a HOWTO here:
http://amigolinux.org/docs/killbill.htm
 
Old 03-15-2005, 10:02 AM   #5
McDe
LQ Newbie
 
Registered: Mar 2005
Location: near Earth
Distribution: Slackware
Posts: 6

Original Poster
Rep: Reputation: 0
Not yet there...yet.

Taken from http://amigolinux.org/docs/killbill.htm
>If you want to boot a linux system where the root file system is on a Linux Native
> partition, you'll need to copy the kernel to a FAT partition along with loadlin.exe
>and linux.bat. See the linux.bat file and follow the directions in README.1ST
>for editing the file

Yes, What I have briefly mentioned is
going from userland mem to ring 0(where the OS works)
<- means internally inWINNT/XP/2000
because, in win9x, they don't give a%#@^& about things like that...
With full compliment, your answer is correct, but limited in the type of OS's to 9x series.

Remember in the old days, from win9x, you ran debug, and did int
to force reading the 0x000000 address, trus (not recommended but) rebooting
your PC(Don't pick on me, this is just a lame example, just proof of concept thing)
You were able to do that because you (practically) had direct hardware access.

Not in the new NT/XP/2000 kernel... But, by allowing various tricks
used by virus and Trojan houses, you can gain enough privilege in
these new OS's(although not recommended) to allow your USERLAND code (Ring 3)
to be run as ring 0 (high privilege, in CPU).

From here, you have direct hardware access, so in theory, nutty people
(like the guys from BeOS developers team)
should be able to write a boot loader, that maps the linux kernel
into the memory, and trus boot linux(with added info from previous OS's).

And in this approach, you don't need to store your linux kernel into any other
partition (theoretically, as long as you somehow get the address where it is stored).
while also allowing 'hijacking' other device drivers, that were meant to run on
other OS's, it can (and will) be used (provided you make a intercommunication
mechanism of windows device driver file structures and the Linux norm way)
to run 'Linux Unsupported Devices' from linux.

It has been done in PowerPC(The Macs), from BeOS.
With the 2.6 kernel, linux could...

Loadlin, unfortunately does not do these things... They just invoke(through DOS).

So I nEEEEEEd technical papers of BeOS loader, and combine it with
the Linux boot loader, AND THEN I can create a application that runs on
Windows NT kernel, form userland, that 'Dynamically' loads linux kernel, etc, etc...

A long way ahead... That's one of the reasons I am posting here...
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Userland ttys don't display full man-pages. ernobe Debian 2 05-16-2005 07:34 PM
token ring support under linux 2.4.21-99 C'evil Linux - Networking 3 02-09-2005 03:39 AM
Linux + Token Ring Half_Elf Linux - Networking 4 09-25-2003 08:34 AM
linux on token ring network Kennie_n2000 Linux - Newbie 1 06-23-2003 02:18 PM
Linux as Token Ring - Ethernet Router ? ccc Linux - Networking 4 01-10-2003 10:43 AM

LinuxQuestions.org > Forums > Non-*NIX Forums > Programming

All times are GMT -5. The time now is 08:26 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration