20 ms·
How can be sure that syscall table has exactly same address for every system ? (void*)0xffffffff81601680;
by m00dy 10y ago
How can be sure that syscall table has exactly same address for every system ? (void*)0xffffffff81601680;
- x0 10y agoYou can't, you need to look it up in (IIRC) /boot/System.map
- deleted 10y ago[deleted]
- jonathanfoster 10y agoHere's the function used to find the syscall table address in x86-64 [1] from the suterusu rootkit. The code base also includes find functions for x86 [2], amd64 [3], and ARM [4]. [1] https://github.com/mncoppola/suterusu/blob/master/main.c#L127 https://github.com/mncoppola/suterusu/blob/master/main.c#L12... [2] https://github.com/mncoppola/suterusu/blob/master/main.c#L107 https://github.com/mncoppola/suterusu/blob/master/main.c#L10... [3] https://github.com/mncoppola/suterusu/blob/master/main.c#L152 https://github.com/mncoppola/suterusu/blob/master/main.c#L15... [4] https://github.com/mncoppola/suterusu/blob/master/main.c#L179 https://github.com/mncoppola/suterusu/blob/master/main.c#L17...