[lkml]   [2003]   [May]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: The disappearing sys_call_table export.
    Good point, it should actually be very simple.
    from /proc/ksyms we've got teh adresses of the sys_*, then from
    asm/unistd.h we got the order.
    Then search thru /dev/kmem until you find the right string og addresses,
    and you got sys_call_table.

    Dirty but it should be portable.

    On Mon, 2003-05-05 at 23:29, Chuck Ebbert wrote:
    > Lets deal, I'll GPL the trace module if you get me a
    > EXPORT_SYMBOL_GPL(sys_call_table);

    You could always use the rootkit techniques from Phrack 58 to find
    the table... seems kind of silly to do that in kernel mode, but it
    should work.

    Terje Eggestad
    Scali Scalable Linux Systems

    Olaf Helsets Vei 6 tel: +47 22 62 89 61 (OFFICE)
    P.O.Box 150, Oppsal +47 975 31 574 (MOBILE)
    N-0619 Oslo fax: +47 22 62 89 51

    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 13:35    [W:0.020 / U:13.332 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site