Hook System Calls in Linux 5.x
how to disable WP when cr0 is "pinned"?
you can read my previous article
according to this stackoverflow question, we cannot:
- disable CR0's Write-Protection bits
- set RO page to RW
i think ive found a solution:
since lkm runs in ring0, why not just write to cr0
directly, why bother …