The syscall table is generally an array of function pointers; these function pointers can be redirected to point to functions implemented in the rootkit, often times an LKM. This type of kernel rootkit is easy to detect compared to other kernel rootkits. A hands on approach is to analyze /proc/kcore with gdb and verify the syscalls against the System.map (A file created at kernel compilation time for debugging purposes). A simpler approach is to run a tool like ktraq, which also has the benefit of disabling this type of rootkit by resetting the syscall function pointers.
A kernel rootkit of this nature would initialize the syscall hooks by using code like the following, which assumes we want to intercept the sys_write, and sys_ioctl syscalls; perhaps we intercept sys_write so that a specific line of text is not written to stdout from /etc/passwd, and sys_getdents64 to hide files.
First define function pointers to point to the original syscalls:
asmlinkage int (*old_write) (int, const void *, size_t);
asmlinkage int (*old_getdents64) (unsigned int, struct dirent *, unsigned int);
Next we would create new syscalls which serve evil purposes i.e.
asmlinkage int new_write(int fd, const void *buf, size_t bytes)
{
... evil code ...
printk(KERN_INFO "This syscall has been hijacked");
... Call original syscall ...
return old_write(fd, buf, bytes);
}
We would do the same with getdents64 -- however this is not a guide on writing rootkits so I will not cover the real details involved.
To perform the actual syscall interception within a kernel module you would do:
-- module_init() -- /* save original */ old_write = (void *) sys_call_table[__NR_write]; /* redirect pointer to new code */ sys_call_table[__NR_write] = (void *) new_write; /* same thing */ old_getdents64 = (void *) sys_call_table[__NR_getdents64]; sys_call_table[__NR_getdents64] = (void *) new_getdents64;
Now future calls to sys_write and sys_getdents64 are going to be executing the code located at new_write and new_getdents64, which will transfer execution over to the original syscall code once finished.
Once the kernel module is removed the syscalls should be reset:
-- module_exit() -- sys_call_table[__NR_write] = (void *)old_write; sys_call_table[__NR_getdents64] = (void *)old_getdents64;
This type of kernel rootkit is still common, but is not as stealth as certain newer methods. There are several tools which can detect this type of kernel rootkit, and even one that can disable them like ktraq which is featured on http://www.bitlackeys.com -- there are however times when a tool like this may not be available etc. Here is a method that is useful for detecting this type of infection:
# grep sys_call_table /boot/System.map
(or /proc/kallsyms if the option for all kernel symbols is enabled)
Assuming the result is: c048d720
