more android rootkit detection

[GoogleCodeExporter]

This plugin detects some more advanced ways of hooking syscall tables by 
modifying the Exception Vector Table or the vector_swi function to change which 
syscall table is being used.

With this plugin as well, as the linux_check_syscall_arm plugin in my last 
issue, we can now detect all the Android rootkit techniques described in this 
phrack article: http://www.phrack.org/issues.html?issue=68&id=6

Original issue reported on code.google.com by Joe.Sylve@gmail.com on 10 Nov 2012 at 10:25

Attachments:

• arm_evtcheck.diff

[GoogleCodeExporter]

Original comment by jamie.l...@gmail.com on 10 Nov 2012 at 11:16

[GoogleCodeExporter]

committed

Original comment by atc...@gmail.com on 29 Jan 2013 at 1:06

• Changed state: Fixed