rootkit

Kernel module crash when reading system call table function address

≯℡__Kan透↙ 提交于 2019-12-01 23:00:13
问题 I am studying rootkits and trying to hook the system call table. As i can already dynamically retrieve the table's address from /boot/System.map-$(uname -r), i traced and isolated the problematic part of the code into an independent, simpler module, shown below. It tries to retrieve and display the address of the kill system call, but insmod returns "Killed" on module load, which is an error provoked specifically on the emphasized line. Kernel version : 5.2.0-3-amd64 Module : #include <linux