Basics of Making a Rootkit – From syscall to hook

Re:Basics of Making a Rootkit – From syscall to hook by m00dy on Sunday December 25, 2016 @05:56PM (#13255846)

How can be sure that syscall table has exactly same address for every system ? (void*)0xffffffff81601680;

[ Parent | on HN ]

Re:Basics of Making a Rootkit – From syscall to hook by x0 on Sunday December 25, 2016 @06:11PM (#13255911)

You can't, you need to look it up in (IIRC) /boot/System.map

[ Parent | on HN ]

Re:Basics of Making a Rootkit – From syscall to hook by jonathanfoster on Monday December 26, 2016 @11:58AM (#13258850)

Here's the function used to find the syscall table address in x86-64 [1] from the suterusu rootkit. The code base also includes find functions for x86 [2], amd64 [3], and ARM [4].

[1] https://github.com/mncoppola/suterusu/blob/master/main.c#L12...

[2] https://github.com/mncoppola/suterusu/blob/master/main.c#L10...

[3] https://github.com/mncoppola/suterusu/blob/master/main.c#L15...

[4] https://github.com/mncoppola/suterusu/blob/master/main.c#L17...

[ Parent | on HN ]