diff --git a/3_RootkitTechniques/README.md b/3_RootkitTechniques/README.md index d71a195..48ad6a5 100644 --- a/3_RootkitTechniques/README.md +++ b/3_RootkitTechniques/README.md @@ -2,6 +2,8 @@ ## 3: Rootkit Techniques +> Updated to work with kernel 5.7+ + There are two main way to hook syscalls via a kernel module. The first, old-fashioned way is to directly modify the `sys_call_table` structure in kernel memory. This is done by modifying the function pointer in this table corresponding to the syscall we're targetting to temporarily point to our own version. By saving the original value of this pointer we can both maintain the original functionality as well as restore the table when we're done. This is what is done in [Section 3.1](./3.1_syscall_hooking). The other more modern method is to use [ftrace](https://www.kernel.org/doc/html/latest/trace/ftrace.html). While it's meant to be used for debugging the kernel, we can use it to replace the arbitrary functions in memory with a hook instead. If you want to understand in detail what's going on with ftrace, then I suggest taking a look at the documentation linked. diff --git a/README.md b/README.md index 2f2d2b0..4f9281e 100644 --- a/README.md +++ b/README.md @@ -6,4 +6,6 @@ Educational purposes only. -Tested on Ubuntu 20.04 and 16.04,via Vagrant - should work on most kernels. +Tested on Ubuntu 20.04 and 16.04, via Vagrant - should work on most kernels. + +> Updated to work with kernels 5.7+