jm33_ng

this commit makes write_cr0(read_cr0() | 0x10000) useless, next time you see a 5.x linux kernel, good luck

according to this stackoverflow question, we cannot:

• disable CR0's Write-Protection bits
• set RO page to RW

i think ive found a solution:

since lkm runs in ring0, why not just write to …

View comments.

Every technique used in this rootkit can be found from internet, I am NOT responsible for any damage you might cause using my code

how ss/netstat fetch TCP/UDP connections

lets do a strace netstat -antu:

...
openat(AT_FDCWD, "/proc/net/tcp", O_RDONLY) = 3
read(3, "  sl  local_address rem_address "..., 4096 …

View comments.