How to write a rootkit without really trying

Summary: Trail of Bits open-sourced KRF, a fault injection tool that intercepts system calls from inside the Linux kernel via a plain kernel module, rewriting the syscall table rather than relying on the dynamic loader. The post walks through retrieving sys_call_table with kallsyms_lookup_name, disabling write-protection by twiddling the 16th bit of the cr0 register, and guarding the critical section against an SMP race condition, noting the technique mirrors PaX/grsecurity's "rare write" mechanism.
Bottom line: The same kernel-module technique the post teaches for fault injection is a working path to syscall interception on any Linux host, and it sidesteps eBPF, which the authors state cannot intercept syscalls at all - only record their parameters and return types.

Read the original at Trail of Bits Blog ↗