【2】Linux内核模块rootkit WNPS分析

本文对Linux内核模块rootkit进行分析，对基于idt hook的WNPS的实现进行分析。

 

完整内容请点击如下链接：

点击打开链接

 

Rootkit. 3

WNPS test run. 4

test env. 4

compile and install4

client run. 4

WNPS explained. 6

WNPS features. 6

WNPS in general6

classic system call and sys_call_table. 7

fast system call - sysenter(Intel)/syscall(AMD) andsysexit. 8

registers. 8

criteria on fast system call8

hook the IDT/sysenter handler. 9

hide. 10

hide the module itself. 11

hide file and process. 11

hide port. 12

network backdoor. 12

filtering network packet. 12

starting the shell13