PTEditor icon indicating copy to clipboard operation
PTEditor copied to clipboard

Use trampoline for kallsyms_lookup_name if CET is enabled on Intel CPUs

Open tristan-hornetz opened this issue 11 months ago • 0 comments

During initialization, the PTEditor kernel module for Linux uses kprobes to get the address for the kallsyms_lookup_name function. However, the address obtained this way does not point to an endbr64 or endbr32 instruction. On CPUs with Intel CET, where the kernel uses Indirect Branch Tracking, calling this address causes a crash.

This commit adds a trampoline for kallsyms_lookup_name , which allows for calling it safely without having to disable Indirect Branch Tracking. Since setting up this trampoline involves hot-patching code, it the commit also adds helper functions to access CR0 and CR4, which we need to modify to disable access restrictions.

tristan-hornetz avatar Mar 10 '25 12:03 tristan-hornetz