1

I came across the term "Kernel Memory Patching" in a presentation. I googled it but couldn't find the exact answer somewhere. My understanding tells me that Kernel Memory Patching is somehow adding or increasing the memory size of kernel or the address space it accesses? Can someone please correct me. Or give more information about this process.

Also, what is the possible difference between:

  • Kernel Memory patching
  • Kernel Patching
  • Loadable kernel module
3

In reverse order because the explanation is a bit easier that way:

  • Loadable kernel module: This refers to a piece of code that can be loaded at runtime by the kernel. Usually these are drivers, but in some cases it may provide extra functionality that has nothing to do with hardware or protocols (for example, add some extra accounting or debugging info). In essense, a kernel module serves the same function as a dynamic library for a userspace program (although the low-level linking is way more complicated). On Linux systems, kernel modules are stored in /lib/modules, on NetBSD (and I think most other BSD systems except OS X) they are found in /stand, and on Windows they are found in various locations in C:\Windows.

  • Kernel patching: Comes in two varieties, live, and offline. Offline kernel patching is essentially just a kernel upgrade (and should be done as such instead of applying a patch to the kernel binary). Live kernel patching is a feature that allows updates to be applied to a running OS kernel with no downtime. On Linux at least, live kernel patches are contained in special kernel modules. Note that live kernel patching is not the same as loading a new version of a driver after unloading the old version (like Windows does when updating certain types of driver).

  • Kernel Memory Patching: This is an ambiguous term out of context, but in every context I've seen, it refers to updating data structures in-memory on a running kernel as part of a live kernel patch. It can also refer to techniques used by some malware to modify kernel memory to trigger an exploit. It rarely has anything to do with the amount of memory in the system, and adding and removing memory is usually called 'hotplugging'.

  • A quick question, can we somehow Load a module on Windows kernel? Lets say a malware that wants to load a module on Windows kernel? Or it is possible only with Linux? – Ibrahim Nadir Jul 27 '17 at 11:45
  • .sys files on Windows are kernel modules. Loading there is much more stringent than on Linux, as the files have to be signed, and have to be listed in certain locations in the registry that aren't trivially accessible to a non-admin user (that's why installing drivers has to be done by the system, or prompts for admin rights). – Austin Hemmelgarn Jul 27 '17 at 11:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.