phyzone

The driver that allows you to interact with physical memory from userspace. It can be used to perform research on hypervisors, sandboxes and Linux-based kernels.

Never use this code in production!

IOCTL Access

• 0x1337 - write phys mem

typedef struct write_struct {
    uint64_t address;
    uint64_t value;
    uint32_t size;
    uint8_t  use_phys_to_virt;
} IOCTL_WRITE;

• 0x1338 - read phys mem

typedef struct read_struct {
    uint64_t address;
    uint32_t size;
    uint8_t  use_phys_to_virt;
} IOCTL_READ;

• 0x1339 - allocate phys mem via dma_alloc_coherent

typedef struct alloc_struct {
    uint32_t size;
} IOCTL_ALLOC;

• 0x1340 - copy to phys mem via copy_from_user

typedef struct copy_struct {
    uint64_t phys_address;
    uint64_t user_address;
    uint64_t size;
} IOCTL_COPY;

use_phys_to_virt - whether to use phys_to_virt or ioremap for kernel-space address translation: ioremap for MMIO mem, phys_to_virt for other.

Developers

• Andrey Chizhov (@moremode) — Senior Vulnerability Researcher @ BI.ZONE
• Pavel Blinnikov (@PavelBlinnikov) — Head of Vulnerability Research @ BI.ZONE