Linux Rootkit for Fun and Profit - 0x04 - emp3r0r
this is a demo of the shell feature that im working on, it supports remote file editing, and FTP-like file get/put, among other things
Hook System Calls in Linux 5.x
how to disable WP when cr0 is "pinned"?
you can read my previous article
according to this stackoverflow question, we cannot:
- disable CR0's Write-Protection bits
- set RO page to RW
i think ive found a solution:
since lkm runs in ring0, why not just write to cr0 directly, why bother …