Designing BSD Rootkits

Chapter 5. RUN-TIME KERNEL MEMORY PATCHING

In the previous chapters we looked at the classic method of introducing code into a running kernel: through a loadable kernel module. In this chapter we'll look at how to patch and augment a running kernel with userland code. This is accomplished by interacting with the /dev/kmem device, which allows us to read from and write to kernel virtual memory. In other words, /dev/kmem allows us to patch the various code bytes (loaded in executable memory space) that control the logic of the kernel. This is commonly referred to as run-time kernel memory patching.

Kernel Data Access Library

The Kernel Data Access Library (libkvm) provides a uniform interface for accessing kernel virtual memory through the /dev/kmem ...