Designing BSD Rootkits

Inline Function Hooking

Recall the problem posed at the end of Patching Call Statements: What do you do when you want to patch some kernel code, but your patch is too big and will overwrite nearby instructions that you require? The answer is: You use an inline function hook.

In general, an inline function hook places an unconditional jump within the body of a function to a region of memory under your control. This memory will contain the "new" code you want the function to execute, the code bytes that were overwritten by the unconditional jump, and an unconditional jump back to the original function. This will extend functionality while preserving original behavior. Of course, you don't have to preserve the original behavior.

Example

In this section ...