Here's the function used to find the syscall table address in x86-64 [1] from the suterusu rootkit. The code base also includes find functions for x86 [2], amd6

Here's the function used to find the syscall table address in x86-64 [1] from the suterusu rootkit. The code base also includes find functions for x86 [2], amd64 [3], and ARM [4]. [1] https://github.com/mncoppola/suterusu/blob/master/main.c#L127 https://github.com/mncoppola/suterusu/blob/master/main.c#L12... [2] https://github.com/mncoppola/suterusu/blob/master/main.c#L107 https://github.com/mncoppola/suterusu/blob/master/main.c#L10... [3] https://github.com/mncoppola/suterusu/blob/master/main.c#L152 https://github.com/mncoppola/suterusu/blob/master/main.c#L15... [4] https://github.com/mncoppola/suterusu/blob/master/main.c#L179 https://github.com/mncoppola/suterusu/blob/master/main.c#L17...