首页
社区
课程
招聘
[原创]Kernel Patch Ultra(BTF特性分支)
发表于: 2025-12-12 17:31 939

[原创]Kernel Patch Ultra(BTF特性分支)

2025-12-12 17:31
939

KernelPatch 是一套针对 arm64 内核的补丁与 hook 工具链,在无源码、无完整符号表的条件下,解析精简内核镜像、恢复符号并注入自定义代码。

当前实验性分支重点利用 BTF(需 CONFIG_DEBUG_INFO_BTF=y)来消除解析结构体信息的问题,显著提升解析准确度和维护性。

新增 / 加强的 BTF 能力

  • 结构体信息补全:基于内核自带 .BTF 节解析结构体成员偏移与大小,解决原版在结构体解析上的痛点。

  • 适配范围扩展:理论支持安卓 Linux 5.10-a13 与 5.15~6.12 的 arm64 内核(即内核为A13之上),覆盖主流 Android GKI 版本。

其他的都和主分支一致,就不多说了(kernelpatch真的知识量满满,佬牛波一),就是解决了结构体修复问题,彻底释放kernelpatch的潜力
关于内核BTF特性,佬们自己ai吧,新分支的代码也是一个想法,通过ai也跑出来了,欢迎有兴趣的佬们进行维护开发。
目前在个人设备px6 6.1运行没问题,其他没设备测
一点日志

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
[    0.002024] [+] KP I Resolving struct offsets using BTF hash table
[    0.002081] [+] KP I found BTF in kernel vaddr: start=0xffffffd7fe445d98, stop=0xffffffd7fe9a60fe, size=0x560366
[    0.002085] [+] KP I BTF header: magic=0xeb9f, version=1, type_len=3331060, str_len=2305882
[    0.002090] [+] KP I parsing BTF types: hdr_len=24, type_off=0, type_len=3331060
[    0.002094] [+] KP I type[0]: kind=4, vlen=8, name_off=1, offset=0
[    0.002097] [+] KP I type[1]: kind=2, vlen=0, name_off=0, offset=108
[    0.002101] [+] KP I type[2]: kind=10, vlen=0, name_off=0, offset=120
[    0.002104] [+] KP I type[3]: kind=1, vlen=0, name_off=88, offset=132
[    0.002107] [+] KP I type[4]: kind=5, vlen=3, name_off=0, offset=148
[    0.006911] [+] KP I parsed 130615 BTF types (validated 130615 types in second pass)
[    0.006920] [+] KP I parsed BTF successfully
[    0.008391] [+] KP I Parsing struct 'task_struct' (216 members)
[    0.023058] [+] KP I Parsing struct 'mm_struct' (2 members)
[    0.023572] [+] KP I Parsing struct 'cred' (26 members)
[    0.024556] [+] KP I Parsing struct 'mount' (27 members)
[    0.025185] [+] KP I Parsing struct 'vm_area_struct' (20 members)
[    0.025456] [+] KP I Parsing struct 'file' (22 members)
[    0.025846] [+] KP I Parsing struct 'inode' (54 members)
[    0.027097] [+] KP I Parsing struct 'dentry' (18 members)
[    0.027365] [+] KP I Parsing struct 'path' (2 members)
[    0.027434] [+] KP I Parsing struct 'page' (5 members)
[    0.027520] [+] KP I Parsing struct 'super_block' (65 members)
[    0.030033] [+] KP I Parsing struct 'input_dev' (53 members)
[    0.031956] [+] KP I Parsing struct 'selinux_policy' (4 members)
[    0.033033] [+] KP I Parsing struct 'policydb' (31 members)
[    0.033471] [+] KP I BTF hash table initialized
[    0.033474] [+] KP I Dumping struct member hash table:
[    0.033478] [+] KP D   task_struct.on_cpu => offset=0x4c type_id=9
[    0.033485] [+] KP D   cred.anon => offset=0xa0 type_id=734
[    0.033490] [+] KP D   input_dev.dev.coherent_dma_mask => offset=0x4e0 type_id=76
[    0.033494] [+] KP D   super_block.s_writers.wait_unfrozen => offset=0x290 type_id=409
[    0.033498] [+] KP D   selinux_policy.policydb.reject_unknown => offset=0x254 type_id=48
[    0.033505] [+] KP D   inode.i_write_hint.subsys => offset=0x8f type_id=1089
[    0.033510] [+] KP D   input_dev.devres_managed => offset=0x600 type_id=94
[    0.033518] [+] KP D   mount.mnt_child.prev => offset=0x90 type_id=34
[    0.033522] [+] KP D   task_struct.futex_exit_mutex.android_oem_data1 => offset=0xa78 type_id=75
[    0.033533] [+] KP D   policydb.len => offset=0x240 type_id=85
[    0.033539] [+] KP D   inode.i_rwsem.wait_lock => offset=0xb4 type_id=61
[    0.033554] [+] KP D   file.f_pos_lock.wait_list => offset=0x58 type_id=33
[    0.033560] [+] KP D   super_block.s_shrink.nr_deferred => offset=0x4b0 type_id=1315
[    0.033571] [+] KP D   file.f_lock => offset=0x30 type_id=121
[    0.033575] [+] KP D   task_struct.tasks.next => offset=0x550 type_id=34
[    0.033579] [+] KP D   input_dev.dev.msi => offset=0x4c0 type_id=429
[    0.033583] [+] KP D   task_struct.trc_reader_nesting => offset=0x4f8 type_id=9
[    0.033587] [+] KP D   task_struct.ioac => offset=0x9a0 type_id=1375

结构体hash表可以通过名称查询offset,也支持动态增加,具体看代码吧
cb8K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6F1K9i4q4A6N6i4q4A6N6i4S2Q4x3V1k6w2k6i4u0F1k6h3I4b7j5i4c8U0K9l9`.`.


[培训]Windows内核深度攻防:从Hook技术到Rootkit实战!

收藏
免费 4
支持
分享
最新回复 (2)
雪    币: 1914
活跃值: (1664)
能力值: ( LV4,RANK:40 )
在线值:
发帖
回帖
粉丝
2
感谢分享
2025-12-15 15:34
0
雪    币: 200
能力值: ( LV1,RANK:0 )
在线值:
发帖
回帖
粉丝
3
感谢分享
2025-12-17 14:39
0
游客
登录 | 注册 方可回帖
返回