Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Basics of Making a Rootkit – From syscall to hook

d0hnuts.com

Post reply on HN
Print view View original

21–23 of 23 posts

Re: Basics of Making a Rootkit – From syscall to hook

#21

Post by mememachine »

>I will not be explaining too much in detail about the code sections as I have left comments that should help. By doing this it encourages the reader to research more and learn more.

I find it so weird to talk about the reader like I am not the reader.

And as a matter of fact, no, it doesnt.

Re: Basics of Making a Rootkit – From syscall to hook

#22

Post by jonathanfoster »

m00dy wrote: post #4

How can be sure that syscall table has exactly same address for every system ? (void*)0xffffffff81601680;

Here's the function used to find the syscall table address in x86-64 [1] from the suterusu rootkit. The code base also includes find functions for x86 [2], amd64 [3], and ARM [4].

[1] https://github.com/mncoppola/suterusu/blob/master/main.c#L12...

[2] https://github.com/mncoppola/suterusu/blob/master/main.c#L10...

[3] https://github.com/mncoppola/suterusu/blob/master/main.c#L15...

[4] https://github.com/mncoppola/suterusu/blob/master/main.c#L17...

Post reply on HN