linux-rootkit

commit ab42aeefe4ff9a31e5fe072f6d3ad9045f17ce1f
parent cc202fa714941c5f024e71c044fe2eeeb39596e9
Author: deurzen <m.deurzen@tum.de>
Date:   Mon, 25 Jan 2021 10:36:38 +0100

implements 0f1f to e9 skipping

Diffstat:
M
mem_forensics/memcheck-gdb.py
 | 
18
++++--------------

1 file changed, 4 insertions(+), 14 deletions(-)
diff --git a/mem_forensics/memcheck-gdb.py b/mem_forensics/memcheck-gdb.py
@@ -624,20 +624,6 @@ class RkCheckFunctions(gdb.Command):
             print("no object file has been read in to calculate offsets, please run `rk-load-symbols` first")
             return None
 
-        md5sum = subprocess.check_output(f"md5sum {file_g}", shell=True).split()[0]
-
-        path = None
-        for root, dirs, files in os.walk("."):
-            if "runtime" in dirs:
-                path = os.path.join(root, f"runtime")
-                break
-
-        if path:
-            with open(f"{path}/md5sum") as f:
-                if md5sum.decode(sys.stdout.encoding) == f.readline().strip():
-                    print("using memoized ELF data stored in `runtime/{func,altinstr,paravirt}`")
-                    self.use_memoization = True
-
         self.f = elffile.ELFFile(open(file_g, "rb"))
         self.s = self.f.get_section_by_name(".symtab")
 
@@ -864,6 +850,10 @@ class RkCheckFunctions(gdb.Command):
                         i += 2
                         continue
 
+                    if elf[i:i+4] == "0f1f" and live[i:i+2] == "e9":
+                        i += 5
+                        continue
+
                     resolved = False
                     break
                 else: