diff --git a/3_RootkitTechniques/3.7_char_interfering/README.md b/3_RootkitTechniques/3.7_char_interfering/README.md index aa716a8..e591d49 100644 --- a/3_RootkitTechniques/3.7_char_interfering/README.md +++ b/3_RootkitTechniques/3.7_char_interfering/README.md @@ -2,6 +2,8 @@ ## 3.6: Interfering with `/dev/random` and `/dev/urandom` +> There is now a blog post explaining this module in a lot more detail. Check it out [here](https://xcellerator.github.io/posts/linux_rootkits_04/)! + Both `/dev/random` and `/dev/urandom` are character devices defined in [`drivers/char/random.c`](https://github.com/torvalds/linux/blob/master/drivers/char/random.c). In particular, we care about the `random_fops` and `urandom_fops` structs which tell us which functions are to be called whenever a process tries to read/write/seek/etc the `random` and `urandom` "files". [Line 1989](https://github.com/torvalds/linux/blob/c70672d8d316ebd46ea447effadfe57ab7a30a50/drivers/char/random.c#L1989) onwards tells us that [`random_read()`](https://github.com/torvalds/linux/blob/c70672d8d316ebd46ea447effadfe57ab7a30a50/drivers/char/random.c#L1861) and [`urandom_read()`](https://github.com/torvalds/linux/blob/c70672d8d316ebd46ea447effadfe57ab7a30a50/drivers/char/random.c#L1842) are responsible.