Skip to content

About

A small kernel module that can hook arbitrary syscalls on x86_64

Resources

Stars

0 stars

Watchers

1 watching

Forks

 
 

Latest commit

 

History

10 Commits

Folders and files

NameName
Last commit message
Last commit date
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Linux Kernel Hook

This is just a small project to hook syscalls in an x86_64 Linux kernel.

Most of the other kernel hooks I've seen on the public internet use an outdated mechanism to grab the syscall table - the oldest tutorials relied on sys_call_table being exported as a public symbol, and slightly newer ones had a brute-forcing approach where they would try to find the syscall table in between two different symbols. This one doesn't do anything that fancy - the load.sh script just greps /proc/kallsyms for the syscall table addresses.

Usage

make
sudo ./scripts/load.sh

About

A small kernel module that can hook arbitrary syscalls on x86_64

Resources

Stars

0 stars

Watchers

1 watching

Forks

Releases

Packages

Contributors

Languages