linux-rootkit

Feature-rich interactive rootkit that targets Linux kernel 4.19, accompanied by a dynamic kernel memory analysis GDB plugin for in vivo introspection (e.g. using QEMU)
git clone git://git.deurzen.net/linux-rootkit
Log | Files | Refs

commit 5afe6141d67f314d79ac6593ee7bc973e60798d8
parent 43355ea847950466f7ba490260a51174395ca16c
Author: deurzen <m.deurzen@tum.de>
Date:   Mon,  8 Feb 2021 10:48:45 +0100

updates slides

Diffstat:
Mproject/slides/presentation.tex | 8+++++---
1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/project/slides/presentation.tex b/project/slides/presentation.tex @@ -111,7 +111,6 @@ \pause \item Trace every memory (write) access on known (vulnerable) memory blocks \begin{itemize} - \item Warn when critical values are written to traced blocks \item We are able to showcase this in a small demo \end{itemize} \end{itemize} @@ -248,7 +247,7 @@ \pause \item Instrumenting \lstinline|gcc| to extract AST (LiveDM) \pause - \item Use \lstinline|clang| to generate an AST without instrumentation + \item Use \lstinline|clang| to generate an AST \pause \item \textcolor{yellow}{Utilize GDB's \lstinline|whatis| command to statically pre-compute type dictionary} \end{itemize} @@ -354,7 +353,10 @@ \pause \item Not feasible within the given time frame \pause - \item Instead, we will demonstrate a small example later based on \textit{hardware} watchpoints + \item Instead, we will demonstrate a small example based on \textit{hardware} watchpoints + \begin{itemize} + \item Warn when critical values are written to traced blocks + \end{itemize} \end{itemize} \end{enumerate} \end{frame}