Re:Basics of Making a Rootkit – From syscall to hook
by jonathanfoster on Monday December 26, 2016 @11:58AM
(#13258850)
Here's the function used to find the syscall table address in x86-64 [1] from the suterusu rootkit. The code base also includes find functions for x86 [2], amd64 [3], and ARM [4].
[1] https://github.com/mncoppola/suterusu/blob/master/main.c#L12...
[2] https://github.com/mncoppola/suterusu/blob/master/main.c#L10...
[3] https://github.com/mncoppola/suterusu/blob/master/main.c#L15...
[4] https://github.com/mncoppola/suterusu/blob/master/main.c#L17...