A Simple Rootkit Example

An important element of a kernel rootkit is its ability to hide itself and cover up what is really going on. Here's one way that some rootkits do that.

When a rootkit is installed, it replaces certain system calls and utilities with its own, modified versions of those routines.

For example, to hide the existence of a file, the rootkit must intercept all system calls that can carry a file name argument, such as open(), chdir() and unlink(). Sidebar: A Simple Rootkit Example - Computerworld

Linked by shanmuga Monday, 30th January 2006 11:57PM