Linux Rootkit for Fun and Profit - 0x03 - LKM - Hide from ss/netstat
Every technique used in this rootkit can be found from internet, I am NOT responsible for any damage you might cause using my code
how ss/netstat fetch TCP/UDP connections
lets do a strace netstat -antu:
...
openat(AT_FDCWD, "/proc/net/tcp", O_RDONLY) = 3
read(3, " sl local_address rem_address "..., 4096 …