Designing BSD Rootkits

Execution Redirection

The execution redirection routine in the example rootkit is achieved by hooking the execve system call. This call is responsible for file execution and is implemented in the file /sys/kern/kern_exec.c as follows.

int
execve(td, uap)
        struct thread *td;
        struct execve_args /* {
                char *fname;
                char **argv;
                char **envv;
        } */ *uap;
{
        int error;
        struct image_args args;

        ❶error = exec_copyin_args(&args, uap->fname, UIO_USERSPACE,
            uap->argv, uap->envv);

        if (error == 0)
                 ❷error = kern_execve(td, &args, NULL);

        exec_free_args(&args);

        return (error);
}

Note how the execve system call ❶ copies in its arguments (uap) from the user data space to a temporary buffer (args) and then ❷ passes that buffer to the kern_execve function, which actually ...