Direct sys_call_table modifications
Traditional kernel rootkits, such as adore and phalanx, worked by overwriting pointers in
sys_call_table so that they would point to a replacement function, which would then call the original syscall as needed. This was accomplished by either an LKM or a program that modified the kernel through
/dev/mem. On today's Linux systems, for security reasons, these writable windows into memory are disabled or are no longer capable of anything but read operations depending on how the kernel is configured. There have been other ways of trying to prevent this type of infection, such as marking
const so that it is stored in the
.rodata section of the text segment. This can be bypassed by marking ...