RedPill - the new loader for 6.2.4 - Discussion


Recommended Posts

6 hours ago, ThorGroup said:

Correct us if we're wrong but the architecture here is such that the kernel uses ASCII-based interface over UART to a bridge. Then the bridge/PMU has I2C for controlling other chips for like LEDs, fans etc. So strictly speaking we don't need I2C for anything.

 

Thats my understanding also. /dev/synobios is a character device, that should accept, kernel and user space communication altough it seems to be locked by secmd.

 

 

Link to post
Share on other sites
On 7/13/2021 at 7:16 AM, ThorGroup said:

The RedPill is back!

As some of you may be aware a lot of research materials as well as the code for parts of the kernel module were pulled from GH. We're happy to report it's back and fully public! Before further ado we have a small sneak-peek of the current state:

Untitled4.thumb.png.c658eaed8c849cdea82a72d25396973a.png

 

Repositories
Both LKM code and the research materials are present in two repositories. Both are automatic forks from our internal serves and are updated few times a day.
 - RedPill LKM: contains the current version of the Linux kernel module source code along with implementation details description
 - DSM Research/Docs: hosts documentation for developers regarding the inner details of DSM boot process


While the dates and authors in both repos are anonymized, the history is preserved. Thus, your forks and PRs will work properly.

 

The Current State
As of now the DSM installs & boots properly (sort of, continue reading). We are currently working on a toolset for generating the loader image automatically so that testing new iterations is easier for people not familiar with full inner workings of the kernel component & the bootloader itself. The tool with instructions will be published in a separate repo.

The kernel module is currently missing the PCI-IDs shimming and RTC emulation. While the latter is most likely not crucial, the former must be implemented. However, it's not really straight-forward as naturally the kernel doesn't have a high-level API to lie about nonexisting hardware ;)

The current revision of the LKM causes some errors to be sent to the PMU. If anyone in the community (@Vortex? @IG-88?) has an idea of what is the source of these we will be grateful for some pointers.
 


--R--R-p--R-4
-9
--R-r-K-8-3-8


As of now we're working on a robust PCI emulation layer. This isn't hard in theory but has many pitfalls if we want to do it properly and none of us ever studied inner workings of PCI on x86 ;) As described in the PCI document in the research repo there are three methods. We picked the third one (full PCI emulation) as it allows for creation of devices which are indistinguishable from real ones. While this is the hardest to pull off properly, it doesn't rely on a hack but rather an official and documented Linux API.


Q&A

  1. Who are you?
    We're a group of passionates dating back to the (great) phreaking times. If you know where to look you will find us on IRC ;)
     
  2. Can I get involved in the development?
    Yes! As this project took a lot from the community we strongly believe it should continue to be shared and developed under GPL. We greatly appreciate any PRs on GH.
     
  3. I'm not a developer, can I help?
    At this stage most likely not. However, we wish to have some testing version not too far in time. For various reasons we cannot (and not willing to) accept any donations. If you want to make us feel better leave a like and a good word for us, as naturally this isn't our full-time job :)))
     
  4. Why is making the code public matters?
    We believe that the code of the loader MUST be public. We aren't sure if the general community is aware of the degree of control the "loader" has over their box. Despite the name it is not just a load-and-leave situation. The majority of the loader code is active in the system for the whole time (you can check that by doing lsmod and looking for an entry which doesn't look like a proper module name but one or more random characters).
    The kernel module can do literally anything you can as root... and more. It can read files, send them in the background somewhere, hide files from you, execute programs with higher-than-root privileges without showing them in any tools, use your CPU while showing 0% in htop etc... and the worst part is that you will never know that it happened (unless you're monitoring your device from the outside).

    However, after this scary paragraph we can say two things: Jun's loader doesn't seem to do any evil things, and the actions any loader needs to perform in the system after the initial load are minimal (e.g. fake responses to "turn on HDD led"). We've also reviewed the code we cloned and it's a solid base.
    Additionally, making the code open means anybody can tinker with it and adjust to new scenarios instead of relying to bit-patching a .ko.
     
  5. What happened to previous repos? Are you crediting the previous author?
    The author of the original code wishes to distance himself from the project and we are respecting that. That's all we know.
     
  6. Do you/anyone have the code of Jun's loader?
    We saw that there's some confusion on the forum regarding Jun's loader and why the work had to start from scratch. Neither the Jun's loader code nor any deeper implementation details regarding inner working of his amazing loader were ever shared with the public. We weren't able to obtain the code through our sources either. There's a good chance he never shared the with anybody.
     
  7. Is Syno trying to block the loader?
    While we cannot comment on any actions, we can surely talk about the code. The new kernel contains something which isn't present before 25556: https://github.com/RedPill-TTG/dsm-research/blob/master/quirks/boot_params-validation.md
    It is true that the "va not found" error triggered by the Jun's loader when used with >6.2.3 is indeed related to offsets which changed in the new build. However, the rabbit hole doesn't stop there. The new "boot_params" check doesn't seem to have any other purpose than detecting violation of the chain of trust. So did the new kernel build broke the loader intentially? Most likely not (it's probably a by-product of the new validation code present very early in the image) but why the boot params validation was placed in 6.2.4 in the first place? We leave the interpretation to the reader.
     
  8. When we can expect a stable release? Will it work on v7?
    We cannot promise any date for two reasons: 1) we can hit an unexpected roadblock (e.g. see errors mentioned above), and 2) we will like to test it and have it working on v6.2.4 and v7 as well (as of now v7 is available for selected devices only and from our tests it is not fully stable even on the devices it was officially released).
    Some of the protections found in v6 were pulled from v7... but don't worry, they will be back as soon as they port them... it's a carrot and a stick situation.

 


cc for people who followed the original topic:

@AleAmadoC @alexku44 @Amoureux @Balrog @blindspot @Bobbenoster @Bobur @coolinx @dimcheff @Fede @FiberInternetUser @gadreel @ilovepancakes @impala_84 @intrax @jarugut @juud @kiwiuk @lemon55 @loomes @minigranis @NeoID @Nuno @Piteball @pkdick1 @pro_info @profet @rufik @s2k7 @scoobdriver@setsunakawa @smilenkovski @smileyworld @smoojay @snakefox666 @Snyaify @SpiRe @T-REX-XP @The Chief @toolazy @vasiliy_gr 

 

Untitled4.png

Thanks for your job!

Link to post
Share on other sites
23 hours ago, flyride said:

 

No, the RS3621xs+ is indirectly supporting NVMe cache through add-in card, but there is no current Synology device that supports all of the desired image-specific features that are available in either DS918+ or DS3617xs: NVMe, Quicksync, RAIDF1 and 16-thread.

What?!?! Are you trying to say the DS3617xs has quicksync? or your just listing desired features that apply to one or the other?

Link to post
Share on other sites
Just now, merve04 said:

just listing desired features that apply to one or the other?

 

Read the question, and you'll understand the answer.  Nothing has changed (choose 16-core/RAIDF1 or Quicksync/NVMe) with legacy or current products thus far.

Link to post
Share on other sites
20 hours ago, ThorGroup said:

We don't compile the kernel. We use DSMs kernel + binary patches from the dsm-research repo patches. You can load the patched image using kexec or repack it to boot from grub. You CANNOT use Jun's loader for this. Currently, we only published sources for the LKM. This is not because we have some secret one but because the kernel modification process is MUCH easier to do.
 

To give you a glimpse of how we do the development we will just say that it's a manual process. We deliberately did not write a step-by-step instruction because we don't want regular folks making YT videos how to hack this around. It is NOT production safe yet. If you want to play with it as a developer simply compile GRUB (or even just copy one from any Linux distro from /boot). Then get the kernel + rd.gz from 25556 PAT file. Next apply binary patches from dsm-research repo and put redpill ko in the rd.gz. Next modify the init script to include redpill loading at the very top.

 

We are looking here and discussing what you guys bring but we publish updates in batches as we don't want to rush with conclusions or publish FUD. It takes some times as we have full time jobs, families, kids, and socialize sometimes too (despite the rumors developers do sometimes leave their caves ;)).

Hello, I followed your method and successfully added redpill.ko to the ramdisk. However, when adding a binary patch to zImage, I successfully decompressed zImage and obtained vmlinux, and used the php file in the GH repo dsm-research for kernel patching, but I don’t know how to package vmlinux into zImage, So, currently I am stuck ramdisk corrupt

Looking forward for your reply, thank you!

11111111111111111111111.png

1222222222222222222.png

Link to post
Share on other sites
5 minutes ago, UnknownO said:

but I don’t know how to package vmlinux into zImage

I tried to search for "vmlinux packaged as zImage" on Google, Baidu, and Bing, but I only found the Android zImage packaging tutorial or Linux compilation tutorial

Edited by UnknownO
Link to post
Share on other sites
18 minutes ago, intrax said:

I found that this does not seem to be zImage, it seems to be bzImage. Because when I checked the information, I found that zImage seems to be compressed with gzip,but this kernel uses lzma compression. And using the file command also shows that this is bzImage(see the upload image).

 

I rummaged through the search engine results, but didn't find a useful one. Basically it is about how to compile Linux to get bzImage...

 

PS:I tried to cut the head of this zImage and merge it with the modified vmlinux compressed by lzma to get a new zImage, but when booted with grub, the virtual machine crashed directly

22222222222222222222222.png

Link to post
Share on other sites
18 minutes ago, UnknownO said:

 

I rummaged through the search engine results, but didn't find a useful one. Basically it is about how to compile Linux to get bzImage...

maybe you can try make bzImage with exist vmlinux.bin

something from jun's scripts

cp $WORKDIR/vmlinux.bin ${OUTDIR}/arch/x86/boot/compressed/vmlinux.bin

$SCRIPT_DIR/genzImage

 

or waitting for original author answer on  https://reverseengineering.stackexchange.com/questions/27803/repacking-vmlinux-into-zimage-bzimage

Link to post
Share on other sites
5 minutes ago, jumkey said:

vmlinux.bin

Does vmlinux.bin here refer to the vmlinux of objcopy?and Where can I download the jun's script?

emmm,In addition, I think no one should reply to this question and answer. This is a question and answer in June.

 

 

Edited by UnknownO
Link to post
Share on other sites
On 7/20/2021 at 2:16 AM, ThorGroup said:

DSM v7 sources
Synology did already publish v7 sources and.... they pulled them quickly: https://sourceforge.net/p/dsgpl/discussion/862835/thread/a519b80124/. They used to be in the "41890branch" as you can see from the project's history: https://sourceforge.net/p/dsgpl/activity/?page=0&limit=100

We weren't lucky enough to get them. Did anyone maybe was able to grab them?

 

Not the folder you mention but anything in here help? https://sourceforge.net/projects/dsgpl/files/toolkit/DSM7.0/

 

Link to post
Share on other sites
On 7/21/2021 at 10:44 PM, UnknownO said:

I can't get genzImage, So now I have no way, wait for ThorGroup to share more details

 

I remember @kiler129 posted that it is very complicated to repack the kernel to bzimage. But I cannot find the thread now as it seems to be deleted. Maybe he can give us some hints.

 

 

Link to post
Share on other sites
On 7/21/2021 at 10:01 PM, jumkey said:

maybe you can try make bzImage with exist vmlinux.bin

something from jun's scripts


cp $WORKDIR/vmlinux.bin ${OUTDIR}/arch/x86/boot/compressed/vmlinux.bin

$SCRIPT_DIR/genzImage

 

or waitting for original author answer on  https://reverseengineering.stackexchange.com/questions/27803/repacking-vmlinux-into-zimage-bzimage

I'm not gonna go into details of how it is done (as I said, it's ~10 pages of notes) as when I clean it up it will be shared as an open-source tool with docs. However I will only say that:

Flow cannot be directly applied to an unpacked kernel, as some files are missing (information is stripped while building the kernel and cannot be recovered from bzImage, yet the process makes calculations based on these pieces)

Some ASM modification is required to the sources to make it buildable

The kernel build process has parts which weren't touched since 90s', and it is at times a very spaghetti code (e.g. bash generating C which generates ASM with printf()s)

Kernel uses non-standard hacky Makefile tricks

Only some objects in the kernel source tree can be MAKEd without building the whole thing

I discovered that the 10-years old script present in the kernel source doesn't ACTUALLY produce a correct file but I had no energy to develop a patch for it

this is kill129 said before

  • Sad 1
Link to post
Share on other sites
16 hours ago, yanjun said:

I'm not gonna go into details of how it is done (as I said, it's ~10 pages of notes) as when I clean it up it will be shared as an open-source tool with docs. However I will only say that:

Flow cannot be directly applied to an unpacked kernel, as some files are missing (information is stripped while building the kernel and cannot be recovered from bzImage, yet the process makes calculations based on these pieces)

Some ASM modification is required to the sources to make it buildable

The kernel build process has parts which weren't touched since 90s', and it is at times a very spaghetti code (e.g. bash generating C which generates ASM with printf()s)

Kernel uses non-standard hacky Makefile tricks

Only some objects in the kernel source tree can be MAKEd without building the whole thing

I discovered that the 10-years old script present in the kernel source doesn't ACTUALLY produce a correct file but I had no energy to develop a patch for it

this is kill129 said before

It seems that we can only wait for ThorGroup to publish the tutorial. .

At my half-hearted level, I can’t solve this problem.😂😭

Link to post
Share on other sites
25 minutes ago, jumkey said:

image.thumb.png.d719a170c2e91671e2b41df765addabf.png

 

repack bzImage by delete cpu.o then stuck at 'booting the kernel'

init file on rd.cpio

#!/bin/sh
insmod redpill.ko
exec /bin/busybox init
 

I can't understand how you repackaged bzimage, can you share more information?

By the way... now you can boot the new kernel and install dsm6.2.4?

Link to post
Share on other sites
3 minutes ago, UnknownO said:

now you can boot the new kernel and install dsm6.2.4?

no just stucked

repacked by skip make vmlinux and fix some compile error

Link to post
Share on other sites
9 hours ago, jumkey said:

no just stucked

repacked by skip make vmlinux and fix some compile error

emmm,I seem to have packaged successfully now, but there may be a problem with the way I added the binary patch, and now all the codes are garbled

 

 

屏幕截图 2021-07-25 114657.png

屏幕截图 2021-07-25 114723.png

Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Restore formatting

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.