Skip to content

Learning Project making versions of rootkits and rootkit detection

Notifications You must be signed in to change notification settings

pranshustuff/rootkit-attack-defence

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

10 Commits
 
 
 
 
 
 
 
 

Repository files navigation

rootkit-attack-defence

Learning Project making versions of rootkits and rootkit detection. A daemon writing "Hello-" every 5 seconds is used to simulate a virus that the "rootkit" hides.

V1

Attack

Using Ftrace to redirect pointer for getdents64 to my version. And removing daemon PID from /proc

Defense

It reads the first bytes of getdents64, looks for an injected JMP/CALL or indirect jump in the function prologue, and flags the target if it points into a loadable kernel module

V2

Defense

Uses eBPF kprobes on getdents64 to capture returned directory entries, parse numeric PIDs from the buffer, compare them to a trusted /proc PID list, and alert when active PIDs are missing.

About

Learning Project making versions of rootkits and rootkit detection

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published