linux-rootkit

Feature-rich interactive rootkit that targets Linux kernel 4.19, accompanied by a dynamic kernel memory analysis GDB plugin for in vivo introspection (e.g. using QEMU)
git clone git://git.deurzen.net/linux-rootkit
Log | Files | Refs

commit 37959d5b7703dfc2474b686edfc04351fe8fa4ef
parent 585214b0fa880056334714f6832b0ebf6b948df7
Author: Tizian Leonhardt <tizianleonhardt@web.de>
Date:   Fri,  5 Feb 2021 23:19:36 +0100

Add more info to LiveDM

Diffstat:
Mproject/slides/presentation.tex | 37+++++++++++++++++++++++++++++++++++--
1 file changed, 35 insertions(+), 2 deletions(-)

diff --git a/project/slides/presentation.tex b/project/slides/presentation.tex @@ -48,12 +48,12 @@ \end{frame} \begin{frame}{\insertsection} - \framesubtitle{LiveDM} + \framesubtitle{LiveDM - Overview} \begin{itemize} \item LiveDM seeks to overcome the previous issues \pause - \item Memory allocations and frees (example: \texttt{kmalloc} and \texttt{kfree}) can be intercepted + \item Memory allocation events can be intercepted \pause \item Going from there, LiveDM is able to create a memory map \pause @@ -61,6 +61,39 @@ \end{itemize} \end{frame} +\begin{frame}{\insertsection} + \framesubtitle{LiveDM - Overview} + + \begin{itemize} + \item Three phases exist to create the mapping: + \begin{enumerate} +\pause + \item Gathering of necessary values +\pause + \item Determining scope of interpretation +\pause + \item Data type interpretation + \end{enumerate} + \end{itemize} +\end{frame} + +\begin{frame}{\insertsection} + \framesubtitle{LiveDM - Phase 1} + + \begin{itemize} + \item Phase 1 is comprised of.. + \begin{itemize} +\pause + \item ..intercepting a set of memory allocation/freeing functions +\pause + \item ..retrieving the requested size, as well as the return value +\pause + \item ..identifying the caller through the stack's return address + \end{itemize} + \end{itemize} +\end{frame} + + %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% \section{Discussion / Questions}