diff --git a/doc/README.md b/doc/README.md index cefe87d..497e2e1 100644 --- a/doc/README.md +++ b/doc/README.md @@ -101,3 +101,17 @@ Option 3: Kernel module {#kernel-module} * Only works with Linux system calls * Also works with statically linked executables +* Only possible with some "hacks" inside the kernel module (to access the Syscall Table) +* [litux.nl?](https://litux.nl/mirror/networksecuritytools/0596007949/networkst-CHP-7-SECT-2.html) + + +Option 4: Emulating {#emulating} +-------------------------------- + +* Valgrind, GDB + + +Option 5: Modifying the kernel {#kernel} +---------------------------------------- + +* Add a special Syscall to intercept/modify other Syscalls