Closed TheThingGoesSkra closed 3 years ago
Hi,
the kallsyms_lookup_name
function is unexported in recent kernel versions according to this.
Workaround: as suggested in the article, you can make use of kprobes. See this repository.
@TheThingGoesSkra to get valid addresses from that file, you must run cat
as the root user, otherwise you get zeros.
Possible (long term) solutions of this issue:
/proc/kallsyms
, suitable when the rootkit is compiled on the machine where it will be used, also requires rootSystem.map
file, more suitable when compiled on an other device, but some systems might not have this fileBoth solutions with header generation suffer from the same issue: if KASLR/KAISER is enabled, only offsets are stored, the base address of the kernel must be determined as well.
It should be fixed now, based on the work from @zizzu0 (https://github.com/zizzu0/LinuxKernelModules/blob/main/FindKallsymsLookupName.c) and @xcellerator (https://xcellerator.github.io/posts/linux_rootkits_11/)
Hello, I installed
linux-headers-(uname -r)
andbuild-essential
and I got this error message when I try to build diamorphine:However the process exist :
Do you know what the problem is, please?