Linux Kernel Stack Size

From testing,

Linux kernel 2.6.24 set process kernel stack size as 4KB
while kernel 2.6.32 set size as 8KB.

Usage: calculating current from ESP, mask 12 or 13 bits....

http://lxr.linux.no/linux+v2.6.32/arch/x86/include/asm/page_32_types.h#L23

Debian kernel Downaloads

Debian 3.0 Woody
Kernle 2.4
http://www.debian.org/releases/woody/

Debian 3.1 Sage
Kernel: 2.4
http://www.debian.org/releases/sarge/debian-installer/

Debian 4.0 Etch
Kernle 2.6.18
http://www.debian.org/releases/etch/

Debian 5.0 Lenny
Kernel
http://www.debian.org/releases/lenny/

Debian 6.0 squeeze
Kernel: 2.6.32
http://www.debian.org/releases/squeeze/

It looks like Debian does not change too much kernel from mainline kernel.
While CentOS changes a lot.

Heap Exploits

BlackHat 2009
https://www.blackhat.com/presentations/bh-usa-09/MCDONALD/BHUSA09-McDonald-WindowsHeap-PAPER.pdf

BlackHat 2010
http://illmatics.com/Understanding_the_LFH.pdf

Heap Overflow exploits

http://heapoverflow.com/

Install Custom Kernel on Ubuntu

Please read: https://help.ubuntu.com/community/Kernel/Compile/

Basically, it only supports kernel from Ubuntu source. It doesn't support mainline kernel from kernel.org.
The source code from mainline kernel could successfully compile, but it cannot boot.
The experiment I had is: automatic restart after loading mainline kernel.

Experiment enviroment:
Ubuntu 11.10 + mainline kernnel 2.6.19

Traversal Widows Process List

Method1:
Using the PsActiveProcessList in EProcess structure

Method 2:
Using the Handle_Table structure in Eprocess structure, and traversal HandleTableList.

kd> dt _Handle_table 0xe1001cd0 

nt!_HANDLE_TABLE

   +0x000 TableCode        : 0xe1002000

   +0x004 QuotaProcess     : (null) 

   +0x008 UniqueProcessId  : 0x00000004 

   +0x00c HandleTableLock  : [4] _EX_PUSH_LOCK

   +0x01c HandleTableList  : _LIST_ENTRY [ 0xe1023e44 - 0x8055b548 ]

   +0x024 HandleContentionEvent : _EX_PUSH_LOCK

   +0x028 DebugInfo        : (null) 

   +0x02c ExtraInfoPages   : 0

   +0x030 FirstFree        : 0x2c4

   +0x034 LastFree         : 0

   +0x038 NextHandleNeedingPool : 0x800

   +0x03c HandleCount      : 252

   +0x040 Flags            : 0

   +0x040 StrictFIFO       : 0y0

Method3: 

Using the queues in scheduler.

Downgrade GCC from 4.6 to 4.4

You could install both 4.6 and 4.4 version

$sudo apt-get install gcc-4.6
$sudo apt-get install gcc-4.4
$sudo apt-get install gcc

$ ls /usr/bin/gcc*

you should see 3 files: gcc, gcc-4.4, gcc-4.6.
And gcc link to gcc-4.6

Then link gcc to gcc-4.4

$ rm /usr/bin/gcc
$ ln -s /usr/bin/gcc-4.4 /usr/bin/gcc

Done!

Install Custom Kernels on CentOS

Read: http://wiki.centos.org/HowTos/Custom_Kernel


Basic, it suports kernel from CentOS source, not from mainline kernel from kernel.org.

But I have been successfully compiled kernel version 2.6.19 based on CentOS 4.5, and version 2.6.24 based on CentOS 5.5.

Steps:
$make menuconfig // need to enable General config-->enable deprecated sysfs 
$make -j4
$make modules_install
$make install



Ref:
https://www.centos.org/modules/newbb/viewtopic.php?topic_id=15198&forum=37&post_id=88760#threadbottom