d

Hooking: The Complete Documentation

• This category contains 1 Papers
• The last paper was added on 2007-03-26 (YYYY-MM-DD)

Linux Per-Process Syscall Hooking

Published on 2006, by Pluf, ©Pluf.

This document describes a new syscall hooking technique for Linux systems and exposes how it can be implemented as part of a virus or a backdoor in order to take full control over an userland application. Although there are some well- known methods for hooking functions, they are mostly based on the ELF format itself. This technique is focused on thoses pieces of code that are externally called by the main program and invoke a system call or system service.

A simple implementation of this hooking mechanism has been developed as a result of the research and it is included with the article. This code provided does not have all the features you wish but includes the required ones, is not a real backdoor but a simple proof of concept, perfect to write your own one.