This module appears to use a simple brute force method for uncovering the address of the system call table, as opposed to hardcoding from System.map. There's an

This module appears to use a simple brute force method for uncovering the address of the system call table, as opposed to hardcoding from System.map. There's another more elegant solution that could be of interest to readers: http://www.elliotbradbury.com/linux-syscall-hooking-interrupt-descriptor-table/ http://www.elliotbradbury.com/linux-syscall-hooking-interrup... If you're looking for deeper case studies on Linux rootkits, the Suterusu rootkit is an interesting PoC: http://poppopret.org/2013/01/07/suterusu-rootkit-inline-kernel-function-hooking-on-x86-and-arm/ http://poppopret.org/2013/01/07/suterusu-rootkit-inline-kern... On the other hand, if you're looking for a guide on understanding LKMs from the ground up and how they can apply to rootkits, I strongly recommend Joseph Kong's excellent book Designing BSD Rootkits. It's FreeBSD-specific and dates to 2007, but it's not still outdated AFAIR: http://www.nostarch.com/rootkits.htm http://www.nostarch.com/rootkits.htm