Home

Detection Tool

This is a simple LKM tool meant to detect LKM rootkits on Linux.

Features

• Detect Hidden PIDs
• Detect Hidden Files
• Detect Hooked Functions
• Detect Hidden Modules

Tested Environments

• Ubuntu 16.04 (4.15.0-45-generic)

Installation

NOTE: Ensure SMAP is disabled (most rootkits will not work with it enabled anyway)

git clone https://github.com/lckjosh/DetectionTool.git
cd DetectionTool
make
gcc client.c -o client

Usage

sudo insmod detectiontool.ko
./client [option]

Options:
[-p] detect hidden PIDs
[-f] detect hidden files
[-s] detect hooked functions
[-m] detect hidden modules

Explanation of Functions

Detect Hidden PIDs

Adapted from the unhide project.
This function compares the outputs of the following system calls:

• kill
• getpriority
• getpgid
• getsid
• sched_getaffinity
• sched_getparam
• sched_getscheduler
• sched_rr_get_interval

along with

• "/proc" entries
• "ps" command.

Detect Hidden Files

// TODO

Detect Hooked Functions

This function detects:

• hooked system calls
• hooked fops for "/", "/proc" and "/sys"

Hooked system calls

This tool is able to detect hooked system calls in the system call table that are hooked via replacing the address of the original function in the table with the address of a hooked function, or by using inline hooking with the unconditional jmp code of

\x48\xb8\x00\x00\x00\x00\x00\x00\x00\x00\xff\xe0

where the 8 bytes in the middle are replaced with the address of the hooked function.

Detect Hidden Modules