Designing BSD Rootkits

Kernel/User Space Transitions

I'll now describe a set of core functions that you can use from kernel space to copy, manipulate, and overwrite the data stored in user space. We'll put these functions to much use throughout this book.

The copyin and copyinstr Functions

The copyin and copyinstr functions allow you to copy a continuous region of data from user space to kernel space.

#include <sys/types.h>
#include <sys/systm.h>

int
copyin(const void *uaddr, void *kaddr, size_t len);

int
copyinstr(const void *uaddr, void *kaddr, size_t len, size_t *done);

The copyin function copies len bytes of data from the user space address uaddr to the kernel space address kaddr.

The copyinstr function is similar, except that it copies a null-terminated string, which ...