linux-rootkit

Feature-rich interactive rootkit that targets Linux kernel 4.19, accompanied by a dynamic kernel memory analysis GDB plugin for in vivo introspection (e.g. using QEMU)
git clone git://git.deurzen.net/linux-rootkit
Log | Files | Refs

example2.asm (479B)


      1 
      2 	BITS 64
      3 	global _start
      4 	section .text
      5 _start:
      6 	push rax
      7 	push rdx
      8 	push rsi
      9 	push rdi
     10 	mov rax, 1
     11 	mov rdi, 0
     12 	mov rsi, memfrobbed
     13 	mov rdx, 0x18
     14 	syscall
     15 	pop rdi
     16 	pop rsi
     17 	pop rdx
     18 	pop rax
     19 	ret
     20 
     21 _my_memfrob:
     22 	xor byte [rdi+rcx-1], 0x42
     23 	loop _my_memfrob
     24 	ret
     25 
     26 	section .data
     27 memfrobbed:
     28 	;db "53cr3t_p4yl04d_g035_h3r3", 0
     29 	db 0x77, 0x71, 0x21, 0x30, 0x71, 0x36, 0x1d, 0x32
     30 	db 0x76, 0x3b, 0x2e, 0x72, 0x76, 0x26, 0x1d, 0x25
     31 	db 0x72, 0x71, 0x77, 0x1d, 0x2a, 0x71, 0x30, 0x71