mirror of
https://github.com/milabs/awesome-linux-rootkits.git
synced 2025-01-08 22:37:55 -05:00
Update README.md
This commit is contained in:
parent
b72fe66edb
commit
9cb4ad8d37
@ -68,7 +68,7 @@ Additional functions:
|
||||
| Management interface | `kill(2)` | `sys_call_table[__NR_kill]` |
|
||||
| Hiding (tampering) of file contents | Filtering while reading | `sys_call_table[__NR_read]` |
|
||||
| Hiding of files and directories | Filtering of directory entries | `sys_call_table[__NR_getdents]` `sys_call_table[__NR_getdents64]` |
|
||||
| Hiding of processes and process trees | Filtering of `/proc` | Filtering PID-like numeric entries while listing `/proc`. Hidden tasks are marked using `task->flags | 0x10000000`. Not able to hide all threads and children of parent process. |
|
||||
| Hiding of processes and process trees | Filtering of `/proc` | Filtering PID-like numeric entries while listing `/proc`. Hidden tasks are marked using `task->flags \| 0x10000000`. Not able to hide all threads and children of hidden (parent) process. |
|
||||
| Detection evasion | Hides own components | Hide files, unlinks module from `module_list`, alters contents of startup files while reading. |
|
||||
|
||||
- https://github.com/QuokkaLight/rkduck
|
||||
|
Loading…
Reference in New Issue
Block a user