Skip to content
This repository has been archived by the owner on Feb 11, 2022. It is now read-only.

debian9 编译加载sys_hook后异常 #30

Open
ihacku opened this issue Apr 18, 2018 · 1 comment
Open

debian9 编译加载sys_hook后异常 #30

ihacku opened this issue Apr 18, 2018 · 1 comment
Assignees
@ihacku @neargle
Labels
bug Something isn't working

Comments

@ihacku
Copy link
Member

ihacku commented Apr 18, 2018

debian9 GCE环境

cat /boot/config-uname -r | grep CONFIG_RETPOLINE
CONFIG_RETPOLINE=y

gcc-6 (6.3.0-18+deb9u1)

uname -r
4.9.0-6-amd64

insmod syshook_execve.ko
加载之后执行任意命令都返回
killed
@neargle neargle added the bug Something isn't working label May 3, 2018
@bootbool
Copy link

@neargle
可否在内核里加个workqueue， 接受命令，延迟发送，避免导致命令直接被kill

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees

@ihacku ihacku

@neargle neargle

Labels
bug Something isn't working
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@ihacku @neargle @bootbool