Modifying DSM 4.3 synobios.ko in Linux.
1. View the source code and look for the second 'ba ff ff ff ff' (25e1) in SetMicropId function using objdump.
# objdump -S synobios.ko | less
orig:
25da: e8 00 00 00 00 callq 25df
25df: 85 c0 test %eax,%eax
25e1: ba ff ff ff ff mov $0xffffffff,%edx
25e6: 75 c4 jne 25ac
25e8: 0f be 04 24 movsbl (%rsp),%eax
25ec: 31 d2 xor %edx,%edx
25ee: 89 05 00 00 00 00 mov %eax,0x0(%rip) # 25f4
2. Replace the next entry (25e6), change it from '75 c4 0f be 04 24' to '48 31 c0 b0 42 90' using xxd.
# xxd -g 1 synobios.ko > synobios.hex
# sed -i 's/75 c4 0f be 04 24/48 31 c0 b0 42 90/' synobios.hex
# xxd -r synobios.hex > synobios-edited.ko
# objdump -S synobios-edited.ko | less
edited:
25da: e8 00 00 00 00 callq 25df
25df: 85 c0 test %eax,%eax
25e1: ba ff ff ff ff mov $0xffffffff,%edx
25e6: 48 31 c0 xor %rax,%rax
25e9: b0 42 mov $0x42,%al
25eb: 90 nop
25ec: 31 d2 xor %edx,%edx
25ee: 89 05 00 00 00 00 mov %eax,0x0(%rip) # 25f4
3. To disable the logging message, find '80 7c 24 17 00' (395) and replace the next entry (39a) with 'eb d4' in synobios_poll function.
# objdump -S synobios.ko | less
orig:
394: c3 retq
395: 80 7c 24 17 00 cmpb $0x0,0x17(%rsp)
39a: 74 d4 je 370
39c: be 24 02 00 00 mov $0x224,%esi
# sed -i 's/80 7c 24 17 00 74 d4/80 7c 24 17 00 eb d4/' synobios.hex
# xxd -r synobios.hex > synobios-edited.ko
# objdump -S synobios-edited.ko | less
edited:
394: c3 retq
395: 80 7c 24 17 00 cmpb $0x0,0x17(%rsp)
39a: eb d4 jmp 370
39c: be 24 02 00 00 mov $0x224,%esi