Designing BSD Rootkits

Cloaking System Call Hooks

Before concluding this chapter, let's take a brief look at a nontrivial application for run-time kernel memory patching: cloaking system call hooks. That is, implementing a system call hook without patching the system call table or any system call function. This is achieved by patching the system call dispatcher with an inline function hook so it references a Trojan system call table instead of the original. This renders the original table functionless, but maintains its integrity, enabling the Trojan table to direct system call requests to any handler you like.

Because the code to do this is rather lengthy (it's longer than mkdir_patch.c), I'll simply explain how it's done and leave the actual code to you.

The system ...