Linux Rootkits Part 2: Ftrace and Function Hooking

This page cannot be shown here. You can still read it on the original site — the toolbar below keeps your place in the directory.

Okay, so you’ve built your first kernel module, but now you want to make it do something cool - something like altering the behaviour of the running kernel. The way we do this is by function hooking, but the question is - how do we know which functions to hook? Luckily for us, there is already a great list of potential targets: syscalls! Syscalls (or system calls) are kernel functions that…

Read on /posts/linux_rootkits_02/ ↗