#syscalltables — Public Fediverse posts

I want to say a big thank you to:
Radare2
Ghidra
x64dbg
Qubes OS

finally but not least; 2 more:

- hfiref0x and to hasherezade
for the extremely useful repos like SysCallTables and crypto_utils they have made

- https://github.com/hfiref0x/SyscallTables
- https://github.com/hasherezade/crypto_utils

#hfiref0x
#hasherezade
#syscalltables #syscall
#radare2 #ghidra #x64dbg #qubes #Qubes_OS

Finding Linux root kits can be hard.
Even if the malware does not touch syscalls directly, it can modify some kernel functions which are activated by one of the system calls. The problem lies in the fact, that these modified functions do not have to be executed during every system call. For example if we modify only some pointer to reading functions in procfs, then the attacker’s code will be executed only when read() is called in order to read some specific file, like /proc/net/

I've found from a file system level detection, you could monitor execution time, but I am curious what other people think.

#security #linux #rootkits #syscalltables