PAXTEST(1)

💖 PAXTEST(1) 💖

okay so bestie, welcome to the paxtest manual page (that's the section 1 of the General Commands Manual, iykyk) — buckle up, it's giving "kernel security girlie" and honestly? obsessed. 🎀

---

✨ NAME ✨

paxtest — a program to test buffer overflow protection 🦋

---

✨ SYNOPSIS ✨

paxtest [kiddie|blackhat]  [logfile]

---

✨ DESCRIPTION ✨

so paxtest is literally a program that attempts to test kernel enforcements over memory usage. the way that some attacks benefit from kernels that do not impose limitations?? yeah. for example, execution in some memory segments makes buffer overflows possible 💀. it's used as a regression test suite for PaX, but it might be useful to test other memory protection patches for the kernel too. no cap.

paxtest runs a set of programs that attempt to subvert memory usage. for example:

Executable anonymous mapping             : Killed
Executable bss                           : Killed
Executable data                          : Killed
Executable heap                          : Killed
Executable stack                         : Killed
Executable anonymous mapping (mprotect)  : Killed
Executable bss (mprotect)                : Killed
Executable data (mprotect)               : Killed
Executable heap (mprotect)               : Killed
Executable shared library bss (mprotect) : Killed
Executable shared library data (mprotect): Killed
Executable stack (mprotect)              : Killed
Anonymous mapping randomisation test     : 16 bits (guessed)
Heap randomisation test (ET_EXEC)        : 13 bits (guessed)
Heap randomisation test (ET_DYN)         : 25 bits (guessed)
Main executable randomisation (ET_EXEC)  : No randomisation
Main executable randomisation (ET_DYN)   : 17 bits (guessed)
Stack randomisation test (SEGMEXEC)      : 23 bits (guessed)
Stack randomisation test (PAGEEXEC)      : 24 bits (guessed)
Return to function (strcpy)              : Vulnerable
Return to function (strcpy, RANDEXEC)    : Vulnerable
Return to function (memcpy)              : Vulnerable
Return to function (memcpy, RANDEXEC)    : Vulnerable
Executable shared library bss            : Killed
Executable shared library data           : Killed
Writable text segments                   : Killed

kay so let me break this down because it's actually so interesting. the Executable ...''</cyan> tests basically put an instruction in a place that is supposed to be data (i.e. `malloc`ed data, C variable, etc.) and tries to execute it 👀. the <lavender>(mprotect)'' tests try to trick the kernel in marking this piece of memory as executable first. sneaky fr. the Return to function tests overwrite the return address on the stack — these are hard to prevent from inside the kernel, which is lowkey tragic 😭. and the last test tries to overwrite memory which is marked as executable.

a normal Linux kernel (unpatched to protect for buffer overflows) will show all tests as Vulnerable and no stack randomisation or 6 bits (due to stack colouring). in other words, on a normal Linux kernel you can execute any data inside a process's memory or overwrite any code at will. it's giving unprotected. it's giving exposed. 💀

this manual page was written for the Debian distribution because the original program does not have a manual page. we're doing charity work out here 🫶

---

🌸 OPTIONS 🌸

this program can take two options: the tests to run, which are indicated using either kiddie or blackhat, and (optionally) a file to which log all the test results.

• kiddie — the test set to run, pick this one 🧚
• blackhat — the other test set to run, pick this one instead 👑
• logfile — optional file to log all the test results to 📝

by default it will log to the user's HOME directory in a paxtest.log file. periodt.

---

✨ SEE ALSO ✨

for more information see PaX Documentation (link to URL http://pax.grsecurity.net/docs) .

---

💜 AUTHOR 💜

paxtest was written by Peter Busser.

this manual page was written by Javier Fernandez-Sanguino jfs@debian.org for the Debian system (but may be used by others) based on the information in the source code and Peter Busser's comments sent to public mailing lists. Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Public License, Version 2 or any later version published by the Free Software Foundation.

---

and that's the whole PAXTEST(1) page bestie — thanks for reading the section 1 manual, ily, go protect ur kernel 💅✨🌈