linux-rootkit

Feature-rich interactive rootkit that targets Linux kernel 4.19, accompanied by a dynamic kernel memory analysis GDB plugin for in vivo introspection (e.g. using QEMU)
git clone git://git.deurzen.net/linux-rootkit
Log | Files | Refs

README.md (1131B)

      1 # LiveDM - Proof of Concept
      2 
      3 This a small user's guide to supplement the slides.
      4 
      5 
      6 
      7 ## Usage
      8 
      9 ### Up-front Setup
     10 
     11 1. Clone the kernel sources. The version has to match that of the running kernel (including the sublevel)!
     12 2. Run `occ.sh`. It takes the path the the kernel sources as its argument and generates all occurrences of our functions of interest.
     13 3. Fire up the VM, attach GDB, and source `type_dict.py`. This will, based on the results of `occ.sh`, generate the dictionary. (Note: this will take ~5 min)
     14 4. The setup is now ready
     15 
     16 ### Memory Tracing
     17 
     18 Simply source `livedm.py` from within GDB. All memory allocations / frees for selected defined functions will now be tracked.
     19 
     20 Commands available:
     21 
     22 ```c
     23 rk-print-mem		Prints the currently allocated memory
     24 rk-debug			Toggle between different output levels*
     25 rk-data <addr>		Output the data inside a buffer/struct; argument is address of rk-print-mem output
     26 ```
     27 
     28 
     29 
     30 Output levels:*
     31 
     32 ```
     33 WARN 	# warn when critical fields (in this case task_struct->cred.uid) change to suspicious values
     34 INFO 	# also print watchpoint additions
     35 TRACE 	# also print every memory allocation
     36 ```
     37