Skip to content

Commit 10827fe

Browse files
committed
wrong syscall name
1 parent 37306d7 commit 10827fe

File tree

1 file changed

+2
-2
lines changed
  • 3_RootkitTechniques/3.2_kill_signalling

1 file changed

+2
-2
lines changed

3_RootkitTechniques/3.2_kill_signalling/README.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,9 @@
44

55
> Updated to use [ftrace](https://www.kernel.org/doc/html/latest/trace/ftrace.html) instead of directly modifying kernel memory
66
7-
We can use the same syscall hijacking method from [Section 3.1](../3.1_syscall_hooking/) to hijack the `sys_kill` syscall rather than `sys_mkdir`. This lets us implement our own custom signals to call different functions within the rootkit. In this case, we use signal `64` (normally unused) to tell the module hide or unhide itself (using the `hideme()` and `showme()` functions from [Section 3.0](../3.0_hiding_lkm/)).
7+
We can use the same syscall hijacking method from [Section 3.1](../3.1_syscall_hooking/) to hijack the `sys_kill` syscall rather than `sys_mkdir`. This lets us implement our own custom signals to call different functions within the rootkit. In this case, we use signal `64` (normally unused) to tell the module to hide or unhide itself (using the `hideme()` and `showme()` functions from [Section 3.0](../3.0_hiding_lkm/)).
88

9-
> NOTE: While experimenting with this module, I found that the kernel kept panicking and crashing if I probed the calls to `sys_mkdir` too often, i.e. trying to `printk` every call signal send to every pid. I think this is probably something to do with a race condition somewhere, but I'm not certain.
9+
> NOTE: While experimenting with this module, I found that the kernel kept panicking and crashing if I probed the calls to `sys_kill` too often, i.e. trying to `printk` every call signal send to every pid. I think this is probably something to do with a race condition somewhere, but I'm not certain.
1010
1111
To use:
1212
* Build with `make`

0 commit comments

Comments
 (0)