From 235dc631aa39530f3de0a74c3865a80eadb4ce42 Mon Sep 17 00:00:00 2001 From: Lorenz Stechauner Date: Sat, 4 Jan 2025 16:15:13 +0100 Subject: [PATCH] doc/README: Add option 4 and 5 --- doc/README.md | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/doc/README.md b/doc/README.md index cefe87d..497e2e1 100644 --- a/doc/README.md +++ b/doc/README.md @@ -101,3 +101,17 @@ Option 3: Kernel module {#kernel-module} * Only works with Linux system calls * Also works with statically linked executables +* Only possible with some "hacks" inside the kernel module (to access the Syscall Table) +* [litux.nl?](https://litux.nl/mirror/networksecuritytools/0596007949/networkst-CHP-7-SECT-2.html) + + +Option 4: Emulating {#emulating} +-------------------------------- + +* Valgrind, GDB + + +Option 5: Modifying the kernel {#kernel} +---------------------------------------- + +* Add a special Syscall to intercept/modify other Syscalls