Finding hidden kernel modules (extrem way reborn): 20 years later
by g1inko (2024)
Phrack Magazine Issue 71 Article 12
https://phrack.org/issues/71/12.html
| Notes |
|---|
| Linux kernel |
| LKM |
| LKM rootkit |
| rootkit |
| hidden kernel module |
| linked list |
| procfs |
| lsmod, rmmod |
| anti-forensics |
| LIST_POISON1, LIST_POISON2 - Kernel 2.5.71 |
| KoviD LKM |
| /sys/modules |
| Volatility |
| sysfs |
| sysfs_remove_file() |
| MODULE_STATE_UNFORMED |
| __module_address() |
| rkspotter |
| module_hunter - madsys |
| module struct |
| kernel patch |
| i386, x86_64 |
| vlalloc() |
| persistence |
| MODULE_STATE_LIVE |
| MODULE_STATE_COMING |
| MODULE_STATE_GOING |
| MODULE_STATE_UNFORMED |
| brute force |
| MODULES_VADDR, MODULES_END macros |
| pgd_present() |
| p4d_present() |
| pvd_present() |
| pmd_present() |
| pte_present |
| MMU |
| mm_struct structure |
| C |
| kern_addr_valid() |
| dump_pagetable() |
| spurious_kernel_fault() |
| mm_find_pmd() |
| CONFIG_PGTABLE_LEVELS |
| CONFIG_X86_5LEVEL |
| nitara2.c |
| init_module() |
| cleanup_module() |
| MODULE_LICENSE() |
| dmesg command |