linux-rootkit

commit 49e29aacc99ade4aa637c4da9163f8b2e6a1bbd6
parent b55c4ff0a3eebb6d4759d722e2bbdfba51b81e85
Author: deurzen <m.deurzen@tum.de>
Date:   Mon,  8 Feb 2021 09:51:16 +0100

adds to slides

Diffstat:
M
project/slides/presentation.tex
 | 
11
++++++++---

1 file changed, 8 insertions(+), 3 deletions(-)
diff --git a/project/slides/presentation.tex b/project/slides/presentation.tex
@@ -258,12 +258,16 @@
 \begin{frame}[fragile]{\insertsection}
   \framesubtitle{Implementing stage 3 --- Performing type interpretation}
     \begin{itemize}
-     \item Process for generating the type dictionary: \footnote{Fully automated, since specific to kernel sources version, build options, and compiler optimizations}
+     \item Process for statically generating the type dictionary: \footnote{Fully automated, since specific to kernel sources version, build options, and compiler optimizations}
 \pause
      \begin{enumerate}
       \item Find all occurences of function calls we are interested in using \lstinline|cscope|
 \pause
-      \item Iterate the generated occurences using Python; execute \lstinline|whatis| on every assigned-to symbol
+      \item Iterate over the generated occurences
+\pause
+      \item Extract the assigned-to symbol name at call site
+\pause
+      \item Execute \lstinline|whatis| on every assigned-to symbol
       \begin{itemize}
 \pause
        \item Assumption: debug symbols for current kernel sources are available
@@ -281,7 +285,8 @@
     \end{itemize}
     \begin{lstlisting}
      "./arch/x86/kernel/e820.c:675": "type = struct e820_table *",
-     "./arch/x86/kernel/e820.c:681": "type = struct e820_table *"
+     "./arch/x86/kernel/e820.c:681": "type = struct e820_table *",
+	 [...]
     \end{lstlisting}
 \end{frame}