Search icon CANCEL
Arrow left icon
Explore Products
Best Sellers
New Releases
Books
Videos
Audiobooks
Learning Hub
Conferences
Free Learning
Arrow right icon
Arrow up icon
GO TO TOP
Learning Linux Binary Analysis

You're reading from   Learning Linux Binary Analysis Learning Linux Binary Analysis

Arrow left icon
Product type Paperback
Published in Feb 2016
Publisher Packt
ISBN-13 9781782167105
Length 282 pages
Edition 1st Edition
Languages
Tools
Arrow right icon
Author (1):
Arrow left icon
Ryan "elfmaster" O'Neill Ryan "elfmaster" O'Neill
Author Profile Icon Ryan "elfmaster" O'Neill
Ryan "elfmaster" O'Neill
Arrow right icon
View More author details
Toc

Table of Contents (11) Chapters Close

Preface 1. The Linux Environment and Its Tools FREE CHAPTER 2. The ELF Binary Format 3. Linux Process Tracing 4. ELF Virus Technology – Linux/Unix Viruses 5. Linux Binary Protection 6. ELF Binary Forensics in Linux 7. Process Memory Forensics 8. ECFS – Extended Core File Snapshot Technology 9. Linux /proc/kcore Analysis Index

Infected LKMs – kernel drivers


So far, we have covered various types of kernel rootkit infections in memory, but I think that this chapter begs a section dedicated to explaining how kernel drivers can be infected by attackers, and how to go about detecting these infections.

Method 1 for infecting LKM files – symbol hijacking

LKMs are ELF objects. To be more specific, they are ET_REL files (object files). Since they are effectively just relocatable code, the ways to infect them, such as hijacking functions, are more limited. Fortunately, there are some kernel-specific mechanisms that take place during the load time of the ELF kernel object, the process of relocating functions within the LKM, that makes infecting them quite easy. The entire method and reasons for it working are described in this wonderful phrack paper at http://phrack.org/issues/68/11.html, but the general idea is simple:

  1. Inject or link in the parasite code to the kernel module.

  2. Change the symbol value of init_module() to have...

lock icon The rest of the chapter is locked
Register for a free Packt account to unlock a world of extra content!
A free Packt account unlocks extra newsletters, articles, discounted offers, and much more. Start advancing your knowledge today.
Unlock this book and the full library FREE for 7 days
Get unlimited access to 7000+ expert-authored eBooks and videos courses covering every tech area you can think of
Renews at $19.99/month. Cancel anytime