[MOD][KERNEL MODULE] wp_mod: disable system write protection

Search This thread

gelo01

Senior Member
Sep 18, 2012
2,403
644
Manila
OnePlus 8T
Does the latest version works with 4.4.4 with software number 3.28.401.7? I saw the name of the zip file and it stated wp_mod_3.28.401.6.zip and not .7.
 

Captain_Throwback

Recognized Developer
Does the latest version works with 4.4.4 with software number 3.28.401.7? I saw the name of the zip file and it stated wp_mod_3.28.401.6.zip and not .7.
It should.

---------- Post added at 11:13 AM ---------- Previous post was at 11:12 AM ----------

Can i try on m8 dual sim ?
Sure you can try it. But it likely won't work without a hex edit. That's easy enough to do, though.
 
  • Like
Reactions: gelo01

ifti_a

Senior Member
Apr 7, 2010
1,369
157
London

mrhamed

Senior Member
Apr 19, 2014
469
43
let/help me use this module

I have HTC OneSV Android: 4.1.2 kernel: 3.4.10-gf43d146, can anybody create this module for me?
thank's
 

gelo01

Senior Member
Sep 18, 2012
2,403
644
Manila
OnePlus 8T
To anyone out here who is on the latest MaximusHD or to anyone who knows, does this kernel module included in the ROM? Or do i have to flash this module separately?

Sent from my HTC One_M8 using XDA Premium 4 mobile app
 

youniqueg33k

Member
May 28, 2014
44
6
Moorhead, MN
I don't understand something...

is nearly in all roms included

I'm new to HTC and just got this M8. Now it is by far the hardest to both root, unlock bootloader and install custom roms of the 3 high end androids I've had, but what exactly is happening that caused the need for this particular work-around? I've had root for several days throughout flashing a few different roms so are people losing root each time the flash a new rom? Is this something that perhaps can solve my S-off issue-that being nothing I try at this point will give me S-off. Otherwise, what am I missing here in this thread?
 

marcusroberts

Senior Member
Jan 1, 2010
60
10
www.marcusroberts.net
I'm new to HTC and just got this M8. Now it is by far the hardest to both root, unlock bootloader and install custom roms of the 3 high end androids I've had, but what exactly is happening that caused the need for this particular work-around? I've had root for several days throughout flashing a few different roms so are people losing root each time the flash a new rom? Is this something that perhaps can solve my S-off issue-that being nothing I try at this point will give me S-off. Otherwise, what am I missing here in this thread?

I bit the bullet and paid $25 for Sunshine to get the s-off. One click and boom, no hassle.
 

bdizzle1686

Senior Member
Jul 28, 2014
1,000
311
37
Washington, MI
Moto Z2 Force
Moto G7
Ah, smart then I think. I've been trying Sunshine but their website didn't mention the $25. Was trying lucky patcher some on it to patch that but nothing yet there :crying:

Dude I'll say it nicely since from your profile, it appears your kinda new here... Don't EVER SAY YOUR TRYING TO USE LUCKY PATCHER ON AN APP HERE ON XDA, ESPECIALLY ON AN APP THAT COMES FROM 1 OF XDA'S MOST WELL KNOWN DEVELOPERS... It's a good way to get yourself banned pretty quickly.... Xda doesn't support the use of Warez apps or any app that can be used to screw a developer out of money... This IS a DEVELOPERS forum, after all.
 
  • Like
Reactions: Tigerstown

furboom1240

Senior Member
Dec 19, 2013
293
59
Erie Canal Zone
Hello, @flar2 I tried your kernel fix for GPE based ROMs. But the link reports that the file was deleted. Can you please re-post the link if possible? Thank you.
By the way, I need a 4.4.4 kernel. Running cm11 m12.

Sent from my One M8 using XDA Free mobile app
 

hopeshadow

Member
Mar 2, 2010
28
2
I tried to insmod the module but I got error:
can'tinsert '/system/lib/modules/wp+mod.ko" : invalid module format1.
In dmesg, I can see wp_mod: disagrees about version of symbol module_layout.

any idea?
 

youniqueg33k

Member
May 28, 2014
44
6
Moorhead, MN
Dude I'll say it nicely since from your profile, it appears your kinda new here... Don't EVER SAY YOUR TRYING TO USE LUCKY PATCHER ON AN APP HERE ON XDA, ESPECIALLY ON AN APP THAT COMES FROM 1 OF XDA'S MOST WELL KNOWN DEVELOPERS... It's a good way to get yourself banned pretty quickly.... Xda doesn't support the use of Warez apps or any app that can be used to screw a developer out of money... This IS a DEVELOPERS forum, after all.

Sorry for that, wasn't thinking when I said it.
 
  • Like
Reactions: bdizzle1686

Top Liked Posts

  • There are no posts matching your filters.
  • 74
    wp_mod: Module to disable system write protection

    This is a kernel module that disables write protection on the system partition while running the stock kernel.


    HTC changed the MMC_MUST_PREVENT_WP_VIOLATION code to make it much harder to crack. I had to redo the module completely, so this is experimental. In the past, it was a simple matter of changing a variable, now we have to replace a function in the kernel so it returns something different, causing the kernel to skip over the write protection code.

    I would caution against loading the module after attempting to make changes to the system partition. It could end up corrupting the filesystem. If the module is loaded at boot, there should be no worries.

    This module will probably need to be updated to load with future kernels when they are released.


    Please consider a donation to support ongoing development
    Many thanks to those who have donated!


    Download:

    wp_mod for GPE Marshmallow 6.0 can be found here:
    http://xdaforums.com/htc-one-m8/general/root-root-marshmallow-gpe-supersu-t3242210


    Sense 4.4.4 (thanks @migascalp):
    http://www.mediafire.com/download/4vyqslnc4crsnto/wp_mod_3.28.401.6.zip


    Sense 4.4.3 (2.22 base):
    wp_mod.ko

    Sense 4.4.2:
    wp_mod.ko

    GPE 4.4.4 (thanks to @italyforever):
    wp_mod.ko

    GPE 4.4.2:
    wp_mod.ko




    Installation:
    Wait for it to be implemented in your favourite ROM

    * or *

    Copy the module to your device, and type
    Code:
    su
    insmod /location-where-you-copied-it/wp_mod.ko


    Changes:

    April 2, 2014 - wp_mod 4.1
    -only return non-existing partition number if called by generic_make_request_checks
    -remove exit from module (we don't want to be able to unload it)
    -clean up code


    March 31, 2014 - wp_mod 4.0
    -new method for HTC One m8



    Source:
    https://github.com/flar2/wp_mod

    Module was compiled against m8 Google Play Edition source. Some symbol CRC checks had to be hexedited in the compiled module to match the stock kernel. Thanks to Michael Coppola for example of function hooking on arm: http://poppopret.org/2013/01/07/suterusu-rootkit-inline-kernel-function-hooking-on-x86-and-arm/#arm
    9
    AWESOME work flar2.

    After examining the source, it is indeed *much* more complicated than it has been in the past. Just curious, if you have the kernel source, what is to stop you from just rewriting the hooked functions instead of hijacking them with this code, which appears to be proof of concept code for ARM rootkits?

    Second question, the very informative page you linked to, and based this on, says this about ARM instruction caching:

    http://poppopret.org/2013/01/07/suterusu-rootkit-inline-kernel-function-hooking-on-x86-and-arm/#arm


    Any reason why you do not use this approach in your module?


    Last and possibly most important question. The page also says this:

    The code uses this approach only to avoid detection by rootkit detectors, something that we should have zero concerns about. Why not use the other approach, system call hooking by swapping out function pointers in the system call table?


    THANK YOU.

    I did rewrite the function. Remember, we have to do this in the running kernel. Whenever the original function is called, it jumps to my new function instead. Hooking/hijacking are the same thing. That site also shows how to hide the module and a bunch of other stealth stuff, but none of that was necessary for this.

    It's extremely easy to disable write protection if you compile your own kernel, you just turn off MMC_MUST_PREVENT_WP_VIOLATION.

    Previously, the wp_mod hack was dead simple. All we had to do was call an existing kernel function to change the number of the partition that write protection applied to. In the new source (below), HTC got rid of all this extraneous code and just hardcoded it to apply the write protection to /system. This happens in block/blk-core.c as you can see below. We need to skip over the quoted code.

    Code:
    static noinline_for_stack bool
    generic_make_request_checks(struct bio *bio)
    {
    
    ......
    
    #ifdef CONFIG_MMC_MUST_PREVENT_WP_VIOLATION
    	sprintf(wp_ptn, "mmcblk0p%d", get_partition_num_by_name("system"));   //hardcoded to look for system partition
    	if (!strcmp(bdevname(bio->bi_bdev, b), wp_ptn) && !board_mfg_mode() &&   //wp_ptn == mmcblk0p45  (/system)
    			(get_tamper_sf() == 1) && (bio->bi_rw & WRITE)) {
    		pr_info("blk-core: Attempt to write protected partition %s block %Lu \n",
    				bdevname(bio->bi_bdev, b), (unsigned long long)bio->bi_sector);
    		err = 0;
    		goto wp_end_io;
    	} else if (atomic_read(&emmc_reboot) && (bio->bi_rw & WRITE)) {
    		pr_info("%s: Attempt to write eMMC, %s block %Lu \n", current->comm,
    				bdevname(bio->bi_bdev, b), (unsigned long long)bio->bi_sector);
    		err = -EROFS;
    		goto wp_end_io;
    	}
    #endif
    
    ..............
    
    }


    It's a *bad idea* to replace a big complicated important function like static noinline_for_stack bool
    generic_make_request_checks() so I decided to modify a simpler function within it, get_partition_num_by_name(). I changed get_partition_num_by_name() to return a different partition number when name == system. I didn't see any code in the kernel source where it would cause a problem to return the wrong partition number for system. After loading wp_mod.ko, write protection is applied to a non-existent partition instead of /system. The end result is exactly the same as my old wp_mod that has proven to work on many devices.


    Why didn't I just change the address in the system call table? I don't think that is so easy on contemporary kernels. I found the function hooking method simpler and more foolproof.


    EDIT: in my haste while answering this at work, I quoted the wrong function containing the write protection code. It's static noinline_for_stack bool
    generic_make_request_checks not bio_check_eod (which is the function right above it in blk-core.c)
    9
    I've updated the module a bit to make it easier to port to future kernels and other devices that use this form of write protection. All that needs to be done is to edit the CRC value for module_layout. I've also made it so the module can't be unloaded, we don't want to do that. In the process, I was able to reduce the module's overhead. Also, as per @m03sizlak's suggestion, I made it so it will only return the non-existent partition if the calling function is generic_make_request_checks.

    The first version works, but we should start testing this version.


    Download:
    wp_mod.ko

    (downloads not showing up for some reason, hold on)


    Changes:
    -only return non-existing partition number if called by generic_make_request_checks
    -remove exit from module (we don't want to be able to unload it)
    -clean up code
    9
    wp_mod for Sense 6 Android 4.4.3 2.22.401.4

    wp_mod.ko
    8
    For users who have init.d support in their ROM. Flash this and your good to go

    https://mega.co.nz/#!XINyDIrB!QcdP3sZJjgKAivkEa7iN8Jusx0e78T1rpA5PT7VGAxQ

    Sent from my Note 3