linux-rootkit

Feature-rich interactive rootkit that targets Linux kernel 4.19, accompanied by a dynamic kernel memory analysis GDB plugin for in vivo introspection (e.g. using QEMU)
git clone git://git.deurzen.net/linux-rootkit
Log | Files | Refs

commit 1ed566f9c42e3f7103e84f3b6e9479d8c4a47b11
parent d257646846d213a2fcbd6ea4b8909af5d29e83a3
Author: deurzen <m.deurzen@tum.de>
Date:   Fri,  5 Feb 2021 01:58:02 +0100

adds *v*alloc variants

Diffstat:
Mproject/extract_sizeret.py | 11++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/project/extract_sizeret.py b/project/extract_sizeret.py @@ -9,11 +9,20 @@ break_arg = { "kmem_cache_alloc_trace": "rdx", "kmalloc_order": "rdi", "__kmalloc": "rdi", + "vmalloc": "rdi", + "vzalloc": "rdi", + "vmalloc_user": "rdi", + "vmalloc_node": "rdi", + "vzalloc_node": "rdi", + "vmalloc_exec": "rdi", + "vmalloc_32": "rdi", + "vmalloc_32_user": "rdi", } free_funcs = { + # *v*free variants all call kfree "kfree": "rdi", - "kmem_cache_free" : "rsi" + "kmem_cache_free" : "rsi", } entries = set()