Basics of Making a Rootkit – From syscall to hook
1–10 of 23 posts
Re: Basics of Making a Rootkit – From syscall to hook
#2I looked into doing this a while ago and came across something that you cant change the syscall table without recompiling the kernel to allow it. I didn't realize a work a round was so trivial.
Re: Basics of Making a Rootkit – From syscall to hook
#3Submitted two days ago:
https://news.ycombinator.com/item?id=13243654
with (AFAICT) the exact same URL. Why didn't the dupe detector catch this?
Re: Basics of Making a Rootkit – From syscall to hook
#4How can be sure that syscall table has exactly same address for every system ? (void*)0xffffffff81601680;
Re: Basics of Making a Rootkit – From syscall to hook
#5(edit: i'm an idiot)
Re: Basics of Making a Rootkit – From syscall to hook
#6How can be sure that syscall table has exactly same address for every system ? (void*)0xffffffff81601680;
You can't, you need to look it up in (IIRC) /boot/System.map
Re: Basics of Making a Rootkit – From syscall to hook
#7Maybe I'm just getting better at C, but this was particularly well written and easy to follow.
Re: Basics of Making a Rootkit – From syscall to hook
#8(edit: i'm an idiot)
I hate memes too, but give this article a go. It's pretty good.
Re: Basics of Making a Rootkit – From syscall to hook
#9Submitted two days ago: https://news.ycombinator.com/item?id=13243654 with (AFAICT) the exact same URL. Why didn't the dupe detector catch this?
No comments, only very few upvotes, then the dupe detector only blocks for a short time AFAIK.