Re:Jellyfish GPU Rootkit
by theamk on Monday November 11, 2019 @10:10PM
(#21511221)
But the hook's .so file still has to be loaded from filesystem, so it should be still detectable?
And even if "hook logic" runs on the GPU, the actual function calls still have plenty of CPU parts. Check out rootkit/kit.c -- it is just plain old LD_PRELOAD rootkit, with a ton of calls running on CPU. Workingmem detector should have no problems matching this code.
And even if "hook logic" runs on the GPU, the actual function calls still have plenty of CPU parts. Check out rootkit/kit.c -- it is just plain old LD_PRELOAD rootkit, with a ton of calls running on CPU. Workingmem detector should have no problems matching this code.