Hacker News Reader

How can be sure that syscall table has exactly same address for every system ? (void*)0xffffffff81601680;

You can't, you need to look it up in (IIRC) /boot/System.map

Here's the function used to find the syscall table address in x86-64 [1] from the suterusu rootkit. The code base also includes find functions for x86 [2], amd64 [3], and ARM [4].

[1] https://github.com/mncoppola/suterusu/blob/master/main.c#L12...

[2] https://github.com/mncoppola/suterusu/blob/master/main.c#L10...

[3] https://github.com/mncoppola/suterusu/blob/master/main.c#L15...

[4] https://github.com/mncoppola/suterusu/blob/master/main.c#L17...

Reply on news.ycombinator.com