admin/TripleCross
1
0
Fork 0
mirror of https://github.com/h3xduck/TripleCross.git synced 2025-12-16 23:33:06 +08:00
Code Issues Packages Projects Releases Wiki Activity

New diagrams, completed rootkit architecture

Browse Source
This commit is contained in:
h3xduck
2022-06-12 08:16:59 -04:00
parent c14b407644
commit 0aec74e024
15 changed files with 463 additions and 335 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
docs/bibliography/bibliography.bib
View File

@@ -609,6 +609,12 @@ AMD64 Architecture Processor Supplement},
url={https://ir0nstone.gitbook.io/notes/types/stack/canaries}
},
@online{rawtcp_lib,
title={RawTCP\_Lib},
author={Marcos Sánchez Bajo},
url={https://github.com/h3xduck/RawTCP_Lib}
}

56
docs/chapters/chapter4.tex
View File

@@ -12,8 +12,10 @@ Taking as a basis these capabilities, this chapter is now dedicated to a compreh
We will firstly present an overview on the rootkit architecture and design. Afterwards, we will be exploring each functionality individually, offering a comprehensive view on how each of the systems work.
\section{Rootkit architecture}
%TODO
Figure \ref{fig:rootkit} shows an overview of the rootkit modules and components which have been built for this research work.
\begin{figure}[htbp]
\centering
\includegraphics[width=15.5cm]{rootkit.jpg}
@@ -21,6 +23,58 @@ We will firstly present an overview on the rootkit architecture and design. Afte
\label{fig:rootkit}
\end{figure}
As we can observe in the figure, we can distinguish 6 different rootkit modules, along with a rootkit client which provides remote control of the rootkit over the network from the attacker machine. Also, there exists a rootkit user space process, which is listening for commands issued from the kernel-side, transmitted through a ring buffer.
\begin{itemize}
\item The \textbf{user space process} of the rootkit is in charge of loading and attaching the eBPF rootkit in the kernel, and creating the eBPF maps needed for their operations. For this, it uses the eBPF programs configurator, an internal structure that manages the eBPF modules at runtime, being able to attach or deattach them after a command to do so is received.
The user space process also listens to any data received at the ring buffer, an special map which the eBPF program at the kernel will use to communicate with the user-side, issuing commands and triggering actions from it. Between others actions, the rootkit user space process can spawn TLS clients, execute malicious programs or use the eBPF program configurator for managing the eBPF programs.
\item The \textbf{library injection} module is in charge of hijacking the execution of target processes by injecting a malicious library. For this, it uses a set of eBPF tracepoints in the kernel side, and a code caver module in the user side in charge of scanning user processes and injecting shellcode, apart from the malicious library itself, which is prepared to communicate with the attacker's remote client.
\item The \textbf{execution hijacking} module is in charge of hijacking the execution of programs right before the process is even created, modifying the kernel function arguments in such a way that the a new malicious program is called, but the original information is not lost so that the malicious program can still create the original process. Therefore, it hijacks the creation of processes by transparently injecting the creation of one additional malicious process on top of the intended one.
\item The \textbf{privilege escalation} module is in charge of ensuring that any user process spawned by the rootkit will maintain full privilege in the system. Therefore, it hijacks any call to the sudoers file (on which privileged users are listed) so that the user on which the rootkit is loaded is always treated as root. Note that we have not listed this module as one of the main project objetives mainly because it acts as a helper to other modules, such as the execution hijacking one.
\item The \textbf{backdoor} is one of the most critical modules in the rootkit. It has full control over incoming traffic with an XDP program, and outgoing traffic with a TC egress program. As we will see, both the XDP and TC programs are loaded in different eBPF programs, so they use a shared eBPF map to communicate between them.
The backdoor maintains a Command and Control (C2) system that is prepared to listen for specially-crafted network triggers which intend to be stealthy and go unnoticed by network firewalls. These triggers transmit information and commands to the XDP program at the network border, which the backdoor is in charge of interpreting and issuing the corresponding actions, either by writing data at an eBPF map in which other eBPF programs are reading, or issuing an action request via the ring buffer. On top of that, the TC program interprets the data parsed by the XDP program and shapes the outgoint traffic, being able to inject secret messages into packets.
\item The \textbf{rootkit stealth} module is in charge of implementing measures to hide the rootkit from the infected host. For this, it hijacks certain system calls so that rootkit-related files and directories are hidden from the system.
\item The \textbf{rootkit persistence} module is in charge of ensuring that the rootkit will stay loaded even after a complete reboot of the infected system. For this, it injects secret files at the \textit{cron} system (which will launch the rootkit after a reboot) and at the sudo system (which maintains the privileged permissions of the rootkit after the reboot).
\item The \textbf{rootkit client} is a command-line interface (CLI) program that enables the attacker to remotely control the rootkit at the infected machine. For this, it incorporates multiple operation modes that launch different commands and network triggers. These network triggers, and any other packet sent to the backdoor, are customly designed TCP packets sent over a raw socket, enabling to avoid the noisy TCP 3-way handshake and to control every detail of the packet fields. Each of the messages generated by the client (and sent by the backdoor) follow a custom rootkit protocol, that defines the format of the messages and allows both the client and the backdoor to identify those packets belonging to this malicious traffic. In order to craft these packets, the rootkit client uses a raw sockets library (RawTCP\_Lib) that we have developed for this purpose \cite{rawtcp_lib}.
The RawTCP\_Lib library incorporates packets building, raw socket packet transmissions, and a sniffer for incoming packets. This sniffer is particularly relevant since the client will need to listen for responses by the rootkit backdoor and quickly detect those that follow the rootkit protocol format.
Apart from the network triggers, upon receiving a response by the backdoor the rootkit client can start pseudo-shells connections (commands can be sent to the backdoor and the backdoor executes them, but no shell process is spawned in the client), or spawn TLS servers that establish an encrypted connection with the backdoor. This connection, internally, still uses the custom rootkit protocol to act as a pseudo-shell, enabling to execute commands remotey.
\end{itemize}
With respect to how the rootkit implementation is distributed into multiple programs, we can find that, overall, there exist 4 main components, as shown in figure \ref{fig:rootkit_files}.
\begin{figure}[htbp]
\centering
\includegraphics[width=15cm]{rootkit_files.jpg}
\caption{Rootkit programs and scripts.}
\label{fig:rootkit_files}
\end{figure}
As we can observe in the figure, the rootkit modules we have overviewed previously are distributed into different files:
\begin{itemize}
\item The program \textit{\textbf{injector}} comprises the rootkit client and the shared library RawTCP\_Lib. This program is to be launched from the attacker machine after a successful infection of a host.
\item The program \textit{\textbf{tc}} contains the TC program needed for managing the egress network traffic. The reason why it is loaded separately is because the libbpf library does not currently incorporate support for integrating TC programs easily as with XDP or tracepoints.
This program is also responsible of creating the shared map which the backdoor will use, and therefore it must be the first part of the rootkit loaded.
\item The program \textit{\textbf{kit}} contains most of the rootkit functionality, spawning the user process and the kernel-side eBPF programs and maps.
\item The \textit{\textbf{packager.sh}} and \textit{\textbf{deployer.sh}} files are scripts which an attacker, upon gaining access to a machine, can use to quickly set up the rootkit and infect the machine:
\begin{itemize}
\item \textit{packager.sh} compiles the rootkit and prepares the \textit{injector}, \textit{kit} and \textit{tc} files in an output directory to be used (this directory is hidden by the rootkit once it is loaded).
\item \textit{deployer.sh} uses the output directory to launch the rootkit files in order (first \textit{tc}, then \textit{kit}). It also injects the necessary files into the sudoers.d and cron.d directories (which will be later hidden by the rootkit) to maintain persistence.
\end{itemize}
\end{itemize}
\section{Library injection attacks}
In this section, we will discuss how to hijack an user process running in the system so that it executes arbitrary code instructed from an eBPF program. For this, we will be injecting a library which will be executed by taking advantage of the fact that the GOT section in ELFs is flagged as writable (as we introduced in section \ref{subsection:elf_lazy_binding} and using the stack scanning technique covered in section \ref{subsection:bpf_probe_write_apps}. This injection will be stealthy (it must not crash the process), and will be able to hijack privileged programs such as systemd, so that the code is executed as root.

65
docs/document.aux
View File

@@ -474,49 +474,53 @@
\@writefile{lof}{\defcounter {refsection}{0}\relax }\@writefile{lof}{\addvspace {10\p@ }}
\@writefile{lot}{\defcounter {refsection}{0}\relax }\@writefile{lot}{\addvspace {10\p@ }}
\@writefile{toc}{\defcounter {refsection}{0}\relax }\@writefile{toc}{\contentsline {section}{\numberline {4.1}Rootkit architecture}{64}{section.4.1}\protected@file@percent }
\@writefile{toc}{\defcounter {refsection}{0}\relax }\@writefile{toc}{\contentsline {section}{\numberline {4.2}Library injection attacks}{64}{section.4.2}\protected@file@percent }
\abx@aux@cite{evil_ebpf_p6974}
\abx@aux@segm{0}{0}{evil_ebpf_p6974}
\abx@aux@cite{evil_ebpf_p6974}
\abx@aux@segm{0}{0}{evil_ebpf_p6974}
\@writefile{lof}{\defcounter {refsection}{0}\relax }\@writefile{lof}{\contentsline {figure}{\numberline {4.1}{\ignorespaces Overview of the rootkit subsystems and components.\relax }}{65}{figure.caption.60}\protected@file@percent }
\newlabel{fig:rootkit}{{4.1}{65}{Overview of the rootkit subsystems and components.\relax }{figure.caption.60}{}}
\@writefile{toc}{\defcounter {refsection}{0}\relax }\@writefile{toc}{\contentsline {subsection}{\numberline {4.2.1}ROP with eBPF}{65}{subsection.4.2.1}\protected@file@percent }
\newlabel{subsection:rop_ebpf}{{4.2.1}{65}{ROP with eBPF}{subsection.4.2.1}{}}
\abx@aux@cite{rawtcp_lib}
\abx@aux@segm{0}{0}{rawtcp_lib}
\@writefile{lof}{\defcounter {refsection}{0}\relax }\@writefile{lof}{\contentsline {figure}{\numberline {4.2}{\ignorespaces Rootkit programs and scripts.\relax }}{67}{figure.caption.61}\protected@file@percent }
\newlabel{fig:rootkit_files}{{4.2}{67}{Rootkit programs and scripts.\relax }{figure.caption.61}{}}
\abx@aux@cite{evil_ebpf_p6974}
\abx@aux@segm{0}{0}{evil_ebpf_p6974}
\abx@aux@cite{evil_ebpf_p6974}
\abx@aux@segm{0}{0}{evil_ebpf_p6974}
\@writefile{toc}{\defcounter {refsection}{0}\relax }\@writefile{toc}{\contentsline {section}{\numberline {4.2}Library injection attacks}{68}{section.4.2}\protected@file@percent }
\@writefile{toc}{\defcounter {refsection}{0}\relax }\@writefile{toc}{\contentsline {subsection}{\numberline {4.2.1}ROP with eBPF}{68}{subsection.4.2.1}\protected@file@percent }
\newlabel{subsection:rop_ebpf}{{4.2.1}{68}{ROP with eBPF}{subsection.4.2.1}{}}
\abx@aux@cite{glibc}
\abx@aux@segm{0}{0}{glibc}
\@writefile{lof}{\defcounter {refsection}{0}\relax }\@writefile{lof}{\contentsline {figure}{\numberline {4.2}{\ignorespaces Initial setup for the ROP with eBPF technique.\relax }}{66}{figure.caption.61}\protected@file@percent }
\newlabel{fig:rop_evil_ebpf_1}{{4.2}{66}{Initial setup for the ROP with eBPF technique.\relax }{figure.caption.61}{}}
\@writefile{lof}{\defcounter {refsection}{0}\relax }\@writefile{lof}{\contentsline {figure}{\numberline {4.3}{\ignorespaces Process memory after syscall exits and ROP code overwrites the stack.\relax }}{67}{figure.caption.62}\protected@file@percent }
\newlabel{fig:rop_evil_ebpf_2}{{4.3}{67}{Process memory after syscall exits and ROP code overwrites the stack.\relax }{figure.caption.62}{}}
\@writefile{lof}{\defcounter {refsection}{0}\relax }\@writefile{lof}{\contentsline {figure}{\numberline {4.3}{\ignorespaces Initial setup for the ROP with eBPF technique.\relax }}{69}{figure.caption.62}\protected@file@percent }
\newlabel{fig:rop_evil_ebpf_1}{{4.3}{69}{Initial setup for the ROP with eBPF technique.\relax }{figure.caption.62}{}}
\@writefile{lof}{\defcounter {refsection}{0}\relax }\@writefile{lof}{\contentsline {figure}{\numberline {4.4}{\ignorespaces Process memory after syscall exits and ROP code overwrites the stack.\relax }}{70}{figure.caption.63}\protected@file@percent }
\newlabel{fig:rop_evil_ebpf_2}{{4.4}{70}{Process memory after syscall exits and ROP code overwrites the stack.\relax }{figure.caption.63}{}}
\abx@aux@cite{canary_exploit}
\abx@aux@segm{0}{0}{canary_exploit}
\@writefile{lof}{\defcounter {refsection}{0}\relax }\@writefile{lof}{\contentsline {figure}{\numberline {4.4}{\ignorespaces Stack data is restored and program continues its execution.\relax }}{68}{figure.caption.63}\protected@file@percent }
\newlabel{fig:rop_evil_ebpf_3}{{4.4}{68}{Stack data is restored and program continues its execution.\relax }{figure.caption.63}{}}
\@writefile{toc}{\defcounter {refsection}{0}\relax }\@writefile{toc}{\contentsline {subsection}{\numberline {4.2.2}Bypassing hardening features in ELFs}{68}{subsection.4.2.2}\protected@file@percent }
\@writefile{lof}{\defcounter {refsection}{0}\relax }\@writefile{lof}{\contentsline {figure}{\numberline {4.5}{\ignorespaces Stack data is restored and program continues its execution.\relax }}{71}{figure.caption.64}\protected@file@percent }
\newlabel{fig:rop_evil_ebpf_3}{{4.5}{71}{Stack data is restored and program continues its execution.\relax }{figure.caption.64}{}}
\@writefile{toc}{\defcounter {refsection}{0}\relax }\@writefile{toc}{\contentsline {subsection}{\numberline {4.2.2}Bypassing hardening features in ELFs}{71}{subsection.4.2.2}\protected@file@percent }
\abx@aux@cite{pie_exploit}
\abx@aux@segm{0}{0}{pie_exploit}
\@writefile{lof}{\defcounter {refsection}{0}\relax }\@writefile{lof}{\contentsline {figure}{\numberline {4.5}{\ignorespaces Two runs of the same executable using ASLR, showing a library and two symbols.\relax }}{69}{figure.caption.64}\protected@file@percent }
\newlabel{fig:alsr_offset}{{4.5}{69}{Two runs of the same executable using ASLR, showing a library and two symbols.\relax }{figure.caption.64}{}}
\@writefile{toc}{\defcounter {refsection}{0}\relax }\@writefile{toc}{\contentsline {subsection}{\numberline {4.2.3}Library injection via GOT hijacking}{70}{subsection.4.2.3}\protected@file@percent }
\newlabel{subsection:got_attack}{{4.2.3}{70}{Library injection via GOT hijacking}{subsection.4.2.3}{}}
\@writefile{lof}{\defcounter {refsection}{0}\relax }\@writefile{lof}{\contentsline {figure}{\numberline {4.6}{\ignorespaces Call to the glibc function, using objdump\relax }}{71}{figure.caption.65}\protected@file@percent }
\newlabel{fig:firstcall}{{4.6}{71}{Call to the glibc function, using objdump\relax }{figure.caption.65}{}}
\@writefile{toc}{\defcounter {refsection}{0}\relax }\@writefile{toc}{\contentsline {chapter}{\numberline {5}Evaluation}{72}{chapter.5}\protected@file@percent }
\@writefile{lof}{\defcounter {refsection}{0}\relax }\@writefile{lof}{\contentsline {figure}{\numberline {4.6}{\ignorespaces Two runs of the same executable using ASLR, showing a library and two symbols.\relax }}{72}{figure.caption.65}\protected@file@percent }
\newlabel{fig:alsr_offset}{{4.6}{72}{Two runs of the same executable using ASLR, showing a library and two symbols.\relax }{figure.caption.65}{}}
\@writefile{toc}{\defcounter {refsection}{0}\relax }\@writefile{toc}{\contentsline {subsection}{\numberline {4.2.3}Library injection via GOT hijacking}{73}{subsection.4.2.3}\protected@file@percent }
\newlabel{subsection:got_attack}{{4.2.3}{73}{Library injection via GOT hijacking}{subsection.4.2.3}{}}
\@writefile{lof}{\defcounter {refsection}{0}\relax }\@writefile{lof}{\contentsline {figure}{\numberline {4.7}{\ignorespaces Call to the glibc function, using objdump\relax }}{74}{figure.caption.66}\protected@file@percent }
\newlabel{fig:firstcall}{{4.7}{74}{Call to the glibc function, using objdump\relax }{figure.caption.66}{}}
\@writefile{toc}{\defcounter {refsection}{0}\relax }\@writefile{toc}{\contentsline {chapter}{\numberline {5}Evaluation}{75}{chapter.5}\protected@file@percent }
\@writefile{lof}{\defcounter {refsection}{0}\relax }\@writefile{lof}{\addvspace {10\p@ }}
\@writefile{lot}{\defcounter {refsection}{0}\relax }\@writefile{lot}{\addvspace {10\p@ }}
\@writefile{toc}{\defcounter {refsection}{0}\relax }\@writefile{toc}{\contentsline {section}{\numberline {5.1}Developed capabilities}{72}{section.5.1}\protected@file@percent }
\@writefile{toc}{\defcounter {refsection}{0}\relax }\@writefile{toc}{\contentsline {section}{\numberline {5.2}Rootkit use cases}{72}{section.5.2}\protected@file@percent }
\@writefile{toc}{\defcounter {refsection}{0}\relax }\@writefile{toc}{\contentsline {chapter}{\numberline {6}Related work}{73}{chapter.6}\protected@file@percent }
\@writefile{toc}{\defcounter {refsection}{0}\relax }\@writefile{toc}{\contentsline {section}{\numberline {5.1}Developed capabilities}{75}{section.5.1}\protected@file@percent }
\@writefile{toc}{\defcounter {refsection}{0}\relax }\@writefile{toc}{\contentsline {section}{\numberline {5.2}Rootkit use cases}{75}{section.5.2}\protected@file@percent }
\@writefile{toc}{\defcounter {refsection}{0}\relax }\@writefile{toc}{\contentsline {chapter}{\numberline {6}Related work}{76}{chapter.6}\protected@file@percent }
\@writefile{lof}{\defcounter {refsection}{0}\relax }\@writefile{lof}{\addvspace {10\p@ }}
\@writefile{lot}{\defcounter {refsection}{0}\relax }\@writefile{lot}{\addvspace {10\p@ }}
\@writefile{toc}{\defcounter {refsection}{0}\relax }\@writefile{toc}{\contentsline {chapter}{Bibliography}{74}{chapter.6}\protected@file@percent }
\newlabel{annex:bpftool_flags_kernel}{{6}{}{Appendix A - Bpftool commands}{chapter*.67}{}}
\newlabel{annex:readelf_commands}{{6}{}{Appendix B - Readelf commands}{chapter*.68}{}}
\newlabel{annexsec:readelf_sec_headers}{{6}{}{}{chapter*.68}{}}
\@writefile{toc}{\defcounter {refsection}{0}\relax }\@writefile{toc}{\contentsline {chapter}{Bibliography}{77}{chapter.6}\protected@file@percent }
\newlabel{annex:bpftool_flags_kernel}{{6}{}{Appendix A - Bpftool commands}{chapter*.68}{}}
\newlabel{annex:readelf_commands}{{6}{}{Appendix B - Readelf commands}{chapter*.69}{}}
\newlabel{annexsec:readelf_sec_headers}{{6}{}{}{chapter*.69}{}}
\newlabel{code:elf_sections}{{6.1}{}{List of ELF section headers with readelf tool of a program compiled with GCC}{lstlisting.6.1}{}}
\@writefile{lol}{\defcounter {refsection}{0}\relax }\@writefile{lol}{\contentsline {lstlisting}{\numberline {6.1}List of ELF section headers with readelf tool of a program compiled with GCC.}{}{lstlisting.6.1}\protected@file@percent }
\abx@aux@read@bbl@mdfivesum{29EDBEBA551C78783A4E376AB79D67BE}
\abx@aux@read@bbl@mdfivesum{F3AD89EA79E7C7C7226521F437E57B7C}
\abx@aux@refcontextdefaultsdone
\abx@aux@defaultrefcontext{0}{ransomware_pwc}{none/global//global/global}
\abx@aux@defaultrefcontext{0}{rootkit_ptsecurity}{none/global//global/global}
@@ -604,8 +608,9 @@
\abx@aux@defaultrefcontext{0}{code_vfs_read}{none/global//global/global}
\abx@aux@defaultrefcontext{0}{evil_ebpf_p6974}{none/global//global/global}
\abx@aux@defaultrefcontext{0}{8664_params_abi_p1922}{none/global//global/global}
\abx@aux@defaultrefcontext{0}{rawtcp_lib}{none/global//global/global}
\abx@aux@defaultrefcontext{0}{glibc}{none/global//global/global}
\abx@aux@defaultrefcontext{0}{canary_exploit}{none/global//global/global}
\abx@aux@defaultrefcontext{0}{pie_exploit}{none/global//global/global}
\ttl@finishall
\gdef \@abspage@last{101}
\gdef \@abspage@last{104}

28
docs/document.bbl
View File

@@ -1400,6 +1400,7 @@
\strng{authorbibnamehash}{c6b49e9e6fbe96fdd89720e842dc0b03}
\strng{authornamehash}{c6b49e9e6fbe96fdd89720e842dc0b03}
\strng{authorfullhash}{c6b49e9e6fbe96fdd89720e842dc0b03}
\field{extraname}{1}
\field{sortinit}{9}
\field{sortinithash}{54047ffb55bdefa0694bbd554c1b11a0}
\field{labelnamesource}{author}
@@ -1907,6 +1908,33 @@
\verb https://raw.githubusercontent.com/wiki/hjl-tools/x86-psABI/x86-64-psABI-1.0.pdf
\endverb
\endentry
\entry{rawtcp_lib}{online}{}
\name{author}{1}{}{%
{{hash=c6b49e9e6fbe96fdd89720e842dc0b03}{%
family={Bajo},
familyi={B\bibinitperiod},
given={Marcos\bibnamedelima Sánchez},
giveni={M\bibinitperiod\bibinitdelim S\bibinitperiod}}}%
}
\strng{namehash}{c6b49e9e6fbe96fdd89720e842dc0b03}
\strng{fullhash}{c6b49e9e6fbe96fdd89720e842dc0b03}
\strng{bibnamehash}{c6b49e9e6fbe96fdd89720e842dc0b03}
\strng{authorbibnamehash}{c6b49e9e6fbe96fdd89720e842dc0b03}
\strng{authornamehash}{c6b49e9e6fbe96fdd89720e842dc0b03}
\strng{authorfullhash}{c6b49e9e6fbe96fdd89720e842dc0b03}
\field{extraname}{2}
\field{sortinit}{1}
\field{sortinithash}{50c6687d7fc80f50136d75228e3c59ba}
\field{labelnamesource}{author}
\field{labeltitlesource}{title}
\field{title}{RawTCP\_Lib}
\verb{urlraw}
\verb https://github.com/h3xduck/RawTCP_Lib
\endverb
\verb{url}
\verb https://github.com/h3xduck/RawTCP_Lib
\endverb
\endentry
\entry{glibc}{online}{}
\field{sortinit}{1}
\field{sortinithash}{50c6687d7fc80f50136d75228e3c59ba}

9
docs/document.bcf
View File

@@ -2456,11 +2456,12 @@
<bcf:citekey order="120">code_vfs_read</bcf:citekey>
<bcf:citekey order="121">evil_ebpf_p6974</bcf:citekey>
<bcf:citekey order="122">8664_params_abi_p1922</bcf:citekey>
<bcf:citekey order="123">evil_ebpf_p6974</bcf:citekey>
<bcf:citekey order="123">rawtcp_lib</bcf:citekey>
<bcf:citekey order="124">evil_ebpf_p6974</bcf:citekey>
<bcf:citekey order="125">glibc</bcf:citekey>
<bcf:citekey order="126">canary_exploit</bcf:citekey>
<bcf:citekey order="127">pie_exploit</bcf:citekey>
<bcf:citekey order="125">evil_ebpf_p6974</bcf:citekey>
<bcf:citekey order="126">glibc</bcf:citekey>
<bcf:citekey order="127">canary_exploit</bcf:citekey>
<bcf:citekey order="128">pie_exploit</bcf:citekey>
</bcf:section>
<!-- SORTING TEMPLATES -->
<bcf:sortingtemplate name="none">

215
docs/document.blg
View File

@@ -1,108 +1,109 @@
[0] Config.pm:311> INFO - This is Biber 2.16
[0] Config.pm:314> INFO - Logfile is 'document.blg'
[61] biber:340> INFO - === Sat Jun 11, 2022, 22:16:42
[76] Biber.pm:415> INFO - Reading 'document.bcf'
[155] Biber.pm:952> INFO - Found 89 citekeys in bib section 0
[170] Biber.pm:4340> INFO - Processing section 0
[179] Biber.pm:4531> INFO - Looking for bibtex format file 'bibliography/bibliography.bib' for section 0
[181] bibtex.pm:1689> INFO - LaTeX decoding ...
[215] bibtex.pm:1494> INFO - Found BibTeX data source 'bibliography/bibliography.bib'
[375] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 9, warning: 1 characters of junk seen at toplevel
[376] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 15, warning: 1 characters of junk seen at toplevel
[376] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 22, warning: 1 characters of junk seen at toplevel
[376] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 28, warning: 1 characters of junk seen at toplevel
[376] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 35, warning: 1 characters of junk seen at toplevel
[376] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 42, warning: 1 characters of junk seen at toplevel
[376] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 50, warning: 1 characters of junk seen at toplevel
[376] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 58, warning: 1 characters of junk seen at toplevel
[376] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 65, warning: 1 characters of junk seen at toplevel
[376] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 70, warning: 1 characters of junk seen at toplevel
[376] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 77, warning: 1 characters of junk seen at toplevel
[376] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 85, warning: 1 characters of junk seen at toplevel
[376] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 94, warning: 1 characters of junk seen at toplevel
[376] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 103, warning: 1 characters of junk seen at toplevel
[376] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 112, warning: 1 characters of junk seen at toplevel
[376] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 121, warning: 1 characters of junk seen at toplevel
[376] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 130, warning: 1 characters of junk seen at toplevel
[376] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 136, warning: 1 characters of junk seen at toplevel
[376] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 141, warning: 1 characters of junk seen at toplevel
[377] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 146, warning: 1 characters of junk seen at toplevel
[377] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 151, warning: 1 characters of junk seen at toplevel
[377] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 162, warning: 1 characters of junk seen at toplevel
[377] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 167, warning: 1 characters of junk seen at toplevel
[377] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 173, warning: 1 characters of junk seen at toplevel
[377] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 179, warning: 1 characters of junk seen at toplevel
[377] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 184, warning: 1 characters of junk seen at toplevel
[377] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 193, warning: 1 characters of junk seen at toplevel
[377] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 200, warning: 1 characters of junk seen at toplevel
[377] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 208, warning: 1 characters of junk seen at toplevel
[377] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 215, warning: 1 characters of junk seen at toplevel
[377] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 224, warning: 1 characters of junk seen at toplevel
[377] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 233, warning: 1 characters of junk seen at toplevel
[377] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 242, warning: 1 characters of junk seen at toplevel
[377] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 248, warning: 1 characters of junk seen at toplevel
[377] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 253, warning: 1 characters of junk seen at toplevel
[377] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 258, warning: 1 characters of junk seen at toplevel
[377] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 265, warning: 1 characters of junk seen at toplevel
[377] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 270, warning: 1 characters of junk seen at toplevel
[378] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 275, warning: 1 characters of junk seen at toplevel
[378] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 280, warning: 1 characters of junk seen at toplevel
[378] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 285, warning: 1 characters of junk seen at toplevel
[378] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 292, warning: 1 characters of junk seen at toplevel
[378] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 297, warning: 1 characters of junk seen at toplevel
[378] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 304, warning: 1 characters of junk seen at toplevel
[378] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 311, warning: 1 characters of junk seen at toplevel
[378] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 318, warning: 1 characters of junk seen at toplevel
[378] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 324, warning: 1 characters of junk seen at toplevel
[378] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 330, warning: 1 characters of junk seen at toplevel
[378] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 336, warning: 1 characters of junk seen at toplevel
[378] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 343, warning: 1 characters of junk seen at toplevel
[378] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 348, warning: 1 characters of junk seen at toplevel
[378] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 353, warning: 1 characters of junk seen at toplevel
[378] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 358, warning: 1 characters of junk seen at toplevel
[378] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 365, warning: 1 characters of junk seen at toplevel
[378] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 370, warning: 1 characters of junk seen at toplevel
[378] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 375, warning: 1 characters of junk seen at toplevel
[378] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 384, warning: 1 characters of junk seen at toplevel
[379] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 389, warning: 1 characters of junk seen at toplevel
[379] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 394, warning: 1 characters of junk seen at toplevel
[379] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 399, warning: 1 characters of junk seen at toplevel
[379] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 404, warning: 1 characters of junk seen at toplevel
[379] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 409, warning: 1 characters of junk seen at toplevel
[379] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 414, warning: 1 characters of junk seen at toplevel
[379] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 419, warning: 1 characters of junk seen at toplevel
[379] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 428, warning: 1 characters of junk seen at toplevel
[379] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 437, warning: 1 characters of junk seen at toplevel
[379] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 442, warning: 1 characters of junk seen at toplevel
[379] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 447, warning: 1 characters of junk seen at toplevel
[379] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 452, warning: 1 characters of junk seen at toplevel
[379] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 458, warning: 1 characters of junk seen at toplevel
[379] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 468, warning: 1 characters of junk seen at toplevel
[379] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 475, warning: 1 characters of junk seen at toplevel
[379] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 482, warning: 1 characters of junk seen at toplevel
[379] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 491, warning: 1 characters of junk seen at toplevel
[379] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 496, warning: 1 characters of junk seen at toplevel
[379] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 501, warning: 1 characters of junk seen at toplevel
[379] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 510, warning: 1 characters of junk seen at toplevel
[379] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 517, warning: 1 characters of junk seen at toplevel
[379] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 524, warning: 1 characters of junk seen at toplevel
[380] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 529, warning: 1 characters of junk seen at toplevel
[380] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 538, warning: 1 characters of junk seen at toplevel
[380] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 547, warning: 1 characters of junk seen at toplevel
[380] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 552, warning: 1 characters of junk seen at toplevel
[380] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 557, warning: 1 characters of junk seen at toplevel
[380] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 564, warning: 1 characters of junk seen at toplevel
[380] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 571, warning: 1 characters of junk seen at toplevel
[380] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 576, warning: 1 characters of junk seen at toplevel
[380] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 581, warning: 1 characters of junk seen at toplevel
[380] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 586, warning: 1 characters of junk seen at toplevel
[380] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 593, warning: 1 characters of junk seen at toplevel
[380] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 600, warning: 1 characters of junk seen at toplevel
[380] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_eUFi/f4d088b3f9f145b5c3058da33afd57d4_33916.utf8, line 607, warning: 1 characters of junk seen at toplevel
[435] UCollate.pm:68> INFO - Overriding locale 'en-US' defaults 'normalization = NFD' with 'normalization = prenormalized'
[435] UCollate.pm:68> INFO - Overriding locale 'en-US' defaults 'variable = shifted' with 'variable = non-ignorable'
[435] Biber.pm:4168> INFO - Sorting list 'none/global//global/global' of type 'entry' with template 'none' and locale 'en-US'
[435] Biber.pm:4174> INFO - No sort tailoring available for locale 'en-US'
[483] bbl.pm:654> INFO - Writing 'document.bbl' with encoding 'UTF-8'
[503] bbl.pm:757> INFO - Output to document.bbl
[503] Biber.pm:128> INFO - WARNINGS: 92
[1] Config.pm:314> INFO - Logfile is 'document.blg'
[152] biber:340> INFO - === Sun Jun 12, 2022, 08:03:16
[185] Biber.pm:415> INFO - Reading 'document.bcf'
[384] Biber.pm:952> INFO - Found 90 citekeys in bib section 0
[420] Biber.pm:4340> INFO - Processing section 0
[439] Biber.pm:4531> INFO - Looking for bibtex format file 'bibliography/bibliography.bib' for section 0
[444] bibtex.pm:1689> INFO - LaTeX decoding ...
[524] bibtex.pm:1494> INFO - Found BibTeX data source 'bibliography/bibliography.bib'
[932] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 9, warning: 1 characters of junk seen at toplevel
[932] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 15, warning: 1 characters of junk seen at toplevel
[932] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 22, warning: 1 characters of junk seen at toplevel
[932] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 28, warning: 1 characters of junk seen at toplevel
[933] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 35, warning: 1 characters of junk seen at toplevel
[933] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 42, warning: 1 characters of junk seen at toplevel
[933] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 50, warning: 1 characters of junk seen at toplevel
[933] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 58, warning: 1 characters of junk seen at toplevel
[934] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 65, warning: 1 characters of junk seen at toplevel
[934] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 70, warning: 1 characters of junk seen at toplevel
[934] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 77, warning: 1 characters of junk seen at toplevel
[934] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 85, warning: 1 characters of junk seen at toplevel
[934] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 94, warning: 1 characters of junk seen at toplevel
[934] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 103, warning: 1 characters of junk seen at toplevel
[935] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 112, warning: 1 characters of junk seen at toplevel
[935] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 121, warning: 1 characters of junk seen at toplevel
[935] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 130, warning: 1 characters of junk seen at toplevel
[935] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 136, warning: 1 characters of junk seen at toplevel
[935] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 141, warning: 1 characters of junk seen at toplevel
[935] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 146, warning: 1 characters of junk seen at toplevel
[935] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 151, warning: 1 characters of junk seen at toplevel
[935] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 162, warning: 1 characters of junk seen at toplevel
[936] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 167, warning: 1 characters of junk seen at toplevel
[936] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 173, warning: 1 characters of junk seen at toplevel
[936] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 179, warning: 1 characters of junk seen at toplevel
[936] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 184, warning: 1 characters of junk seen at toplevel
[936] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 193, warning: 1 characters of junk seen at toplevel
[936] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 200, warning: 1 characters of junk seen at toplevel
[936] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 208, warning: 1 characters of junk seen at toplevel
[936] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 215, warning: 1 characters of junk seen at toplevel
[936] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 224, warning: 1 characters of junk seen at toplevel
[937] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 233, warning: 1 characters of junk seen at toplevel
[937] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 242, warning: 1 characters of junk seen at toplevel
[937] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 248, warning: 1 characters of junk seen at toplevel
[937] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 253, warning: 1 characters of junk seen at toplevel
[937] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 258, warning: 1 characters of junk seen at toplevel
[937] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 265, warning: 1 characters of junk seen at toplevel
[938] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 270, warning: 1 characters of junk seen at toplevel
[938] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 275, warning: 1 characters of junk seen at toplevel
[938] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 280, warning: 1 characters of junk seen at toplevel
[938] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 285, warning: 1 characters of junk seen at toplevel
[938] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 292, warning: 1 characters of junk seen at toplevel
[938] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 297, warning: 1 characters of junk seen at toplevel
[939] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 304, warning: 1 characters of junk seen at toplevel
[939] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 311, warning: 1 characters of junk seen at toplevel
[939] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 318, warning: 1 characters of junk seen at toplevel
[939] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 324, warning: 1 characters of junk seen at toplevel
[939] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 330, warning: 1 characters of junk seen at toplevel
[939] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 336, warning: 1 characters of junk seen at toplevel
[939] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 343, warning: 1 characters of junk seen at toplevel
[940] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 348, warning: 1 characters of junk seen at toplevel
[940] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 353, warning: 1 characters of junk seen at toplevel
[940] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 358, warning: 1 characters of junk seen at toplevel
[940] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 365, warning: 1 characters of junk seen at toplevel
[940] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 370, warning: 1 characters of junk seen at toplevel
[940] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 375, warning: 1 characters of junk seen at toplevel
[940] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 384, warning: 1 characters of junk seen at toplevel
[940] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 389, warning: 1 characters of junk seen at toplevel
[940] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 394, warning: 1 characters of junk seen at toplevel
[941] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 399, warning: 1 characters of junk seen at toplevel
[941] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 404, warning: 1 characters of junk seen at toplevel
[941] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 409, warning: 1 characters of junk seen at toplevel
[941] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 414, warning: 1 characters of junk seen at toplevel
[941] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 419, warning: 1 characters of junk seen at toplevel
[941] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 428, warning: 1 characters of junk seen at toplevel
[941] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 437, warning: 1 characters of junk seen at toplevel
[941] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 442, warning: 1 characters of junk seen at toplevel
[941] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 447, warning: 1 characters of junk seen at toplevel
[942] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 452, warning: 1 characters of junk seen at toplevel
[942] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 458, warning: 1 characters of junk seen at toplevel
[942] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 468, warning: 1 characters of junk seen at toplevel
[942] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 475, warning: 1 characters of junk seen at toplevel
[942] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 482, warning: 1 characters of junk seen at toplevel
[942] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 491, warning: 1 characters of junk seen at toplevel
[942] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 496, warning: 1 characters of junk seen at toplevel
[943] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 501, warning: 1 characters of junk seen at toplevel
[943] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 510, warning: 1 characters of junk seen at toplevel
[943] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 517, warning: 1 characters of junk seen at toplevel
[943] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 524, warning: 1 characters of junk seen at toplevel
[943] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 529, warning: 1 characters of junk seen at toplevel
[943] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 538, warning: 1 characters of junk seen at toplevel
[944] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 547, warning: 1 characters of junk seen at toplevel
[944] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 552, warning: 1 characters of junk seen at toplevel
[944] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 557, warning: 1 characters of junk seen at toplevel
[944] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 564, warning: 1 characters of junk seen at toplevel
[944] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 571, warning: 1 characters of junk seen at toplevel
[945] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 576, warning: 1 characters of junk seen at toplevel
[945] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 581, warning: 1 characters of junk seen at toplevel
[945] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 586, warning: 1 characters of junk seen at toplevel
[945] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 593, warning: 1 characters of junk seen at toplevel
[945] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 600, warning: 1 characters of junk seen at toplevel
[945] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 607, warning: 1 characters of junk seen at toplevel
[946] Utils.pm:384> WARN - BibTeX subsystem: /tmp/biber_tmp_KEwd/f4d088b3f9f145b5c3058da33afd57d4_37100.utf8, line 612, warning: 1 characters of junk seen at toplevel
[1082] UCollate.pm:68> INFO - Overriding locale 'en-US' defaults 'variable = shifted' with 'variable = non-ignorable'
[1082] UCollate.pm:68> INFO - Overriding locale 'en-US' defaults 'normalization = NFD' with 'normalization = prenormalized'
[1083] Biber.pm:4168> INFO - Sorting list 'none/global//global/global' of type 'entry' with template 'none' and locale 'en-US'
[1083] Biber.pm:4174> INFO - No sort tailoring available for locale 'en-US'
[1198] bbl.pm:654> INFO - Writing 'document.bbl' with encoding 'UTF-8'
[1250] bbl.pm:757> INFO - Output to document.bbl
[1251] Biber.pm:128> INFO - WARNINGS: 93

54
docs/document.fdb_latexmk
View File

@@ -1,11 +1,11 @@
# Fdb version 3
["biber document"] 1654942894 "document.bcf" "document.bbl" "document" 1654942909
"bibliography/bibliography.bib" 1654855012 17898 4449d891eca50db2bc784728c4927241 ""
"document.bcf" 1654942909 112735 e361b1bed81aebb7598fbdc9521e00e0 "pdflatex"
["biber document"] 1655033977 "document.bcf" "document.bbl" "document" 1655035060
"bibliography/bibliography.bib" 1655035048 18430 177b878d10dd97fdcc8937e99ad0727c ""
"document.bcf" 1655035030 112916 05490f4de56d62d39a634dbc315966a7 "pdflatex"
(generated)
"document.blg"
"document.bbl"
["pdflatex"] 1654942903 "document.tex" "document.pdf" "document" 1654942909
"document.blg"
["pdflatex"] 1655035060 "document.tex" "document.pdf" "document" 1655035060
"/etc/texmf/web2c/texmf.cnf" 1651100307 475 c0e671620eb5563b2130f56340a5fde8 ""
"/usr/share/texlive/texmf-dist/fonts/enc/dvips/base/8r.enc" 1165713224 4850 80dc9bab7f31fb78a000ccfed0e27cab ""
"/usr/share/texlive/texmf-dist/fonts/map/fontname/texfonts.map" 1577235249 3524 cb3e574dea2d1052e39280babc910dc8 ""
@@ -15,6 +15,7 @@
"/usr/share/texlive/texmf-dist/fonts/tfm/public/txfonts/rtxb.tfm" 1136768653 1020 c53143d3e3747b5c1149bd9a5ecd7b55 ""
"/usr/share/texlive/texmf-dist/fonts/tfm/public/txfonts/rtxbss.tfm" 1136768653 952 8af6d4411025237a8a19c5fe76c48519 ""
"/usr/share/texlive/texmf-dist/fonts/tfm/public/txfonts/rtxi.tfm" 1136768653 1048 a97cff5f6b833b712079817ce7a40d4c ""
"/usr/share/texlive/texmf-dist/fonts/tfm/public/txfonts/rtxmi.tfm" 1136768653 1056 e2202af076e43d03fc17f87e104021b0 ""
"/usr/share/texlive/texmf-dist/fonts/tfm/public/txfonts/rtxphvb.tfm" 1136768653 4548 1ffa7e4f8cec4f54428bd6e887feff07 ""
"/usr/share/texlive/texmf-dist/fonts/tfm/public/txfonts/rtxphvr.tfm" 1136768653 4748 767b775b8de19d97ba9256ce2b48e057 ""
"/usr/share/texlive/texmf-dist/fonts/tfm/public/txfonts/rtxphvro.tfm" 1136768653 4964 9484ade2f7ca166fd2b0a8266351209c ""
@@ -64,6 +65,7 @@
"/usr/share/texlive/texmf-dist/fonts/vf/public/txfonts/t1xsssl.vf" 1136768653 2148 3b03d03d82cf6e8c21b92d2903f15dc8 ""
"/usr/share/texlive/texmf-dist/fonts/vf/public/txfonts/tcxi.vf" 1136768653 988 94d927596240fbacbfb7297449727f1c ""
"/usr/share/texlive/texmf-dist/fonts/vf/public/txfonts/tcxr.vf" 1136768653 988 4f41b8c123e4537adb7f2dbb638d2981 ""
"/usr/share/texlive/texmf-dist/fonts/vf/public/txfonts/txmi.vf" 1232065820 960 cfcc9d587b40b769f64408b3ca115941 ""
"/usr/share/texlive/texmf-dist/tex/context/base/mkii/supp-pdf.mkii" 1461363279 71627 94eb9990bed73c364d7f53f960cc8c5b ""
"/usr/share/texlive/texmf-dist/tex/generic/atbegshi/atbegshi.sty" 1575674566 24708 5584a51a7101caf7e6bbf1fc27d8f7b1 ""
"/usr/share/texlive/texmf-dist/tex/generic/babel-english/english.ldf" 1496785618 7008 9ff5fdcc865b01beca2b0fe4a46231d4 ""
@@ -205,19 +207,19 @@
"/var/lib/texmf/web2c/pdftex/pdflatex.fmt" 1651100326 1334284 230f0b70f00981bccbdb458564f1009e ""
"chapters/annex.tex" 1654942022 7244 529cbb32d3e651576b8b59f587b12ca7 ""
"chapters/chapter1.tex" 1654942427 11443 47a32930700b882ae00123de9261e211 ""
"chapters/chapter2.tex" 1654942827 54083 3ad1b2ddf80c992578d1017c39ed1128 ""
"chapters/chapter3.tex" 1654942812 44397 23633e76820182b9375fed24892da81a ""
"chapters/chapter4.tex" 1654907124 34837 aebe2df6aebf5e0bb6957ee38a061539 ""
"chapters/chapter5.tex" 1654941579 20 b9bf1a6cc1f320bfe01b8d488d2ded14 ""
"chapters/chapter6.tex" 1654941594 22 a4763c43dfb96d01585aff2eaff0ccbe ""
"document.aux" 1654942909 60576 86eaa0b701ca0506b6ef9fd0e11eb3f6 "pdflatex"
"document.bbl" 1654942896 73417 0278de2a07b515b57955b64a1f5bd851 "biber document"
"document.lof" 1654942909 7233 f53b6bec69e38cfc89457a8a5b38451c "pdflatex"
"document.lot" 1654942909 5361 771dd7d79ed4c15da4ae237011a6548e "pdflatex"
"document.out" 1654942909 5406 ce2aa95f08fbe7ebddaeb67089365827 "pdflatex"
"document.run.xml" 1654942909 2445 b409c18254f7f5782630d13a05948f21 "pdflatex"
"document.tex" 1654942068 6713 eb3647ce32b19002e48c2c97d8fb2840 ""
"document.toc" 1654942909 8699 ba841e8da4ee1740b24ec705fa08ca20 "pdflatex"
"chapters/chapter2.tex" 1654979192 89509 2f1924ef75a8fa0f5d49e777ad921305 ""
"chapters/chapter3.tex" 1654979454 32862 389955387b3f2b0401c89199fbd811d0 ""
"chapters/chapter4.tex" 1655035016 22079 0217c7f2a7786208e4d6c266473cda8b ""
"chapters/chapter5.tex" 1654966992 81 44003c0d65e545a114628ca35b603084 ""
"chapters/chapter6.tex" 1654967052 143 6ba964fe2a782e2ffb7aa2315fbb4183 ""
"document.aux" 1655035030 61616 4008edbae5e661cb9588353acd9afdad "pdflatex"
"document.bbl" 1655033979 76366 6af5917e230bae3b7774793a68864f65 "biber document"
"document.lof" 1655035030 7503 372bb7c74e6ff547ead2b5bf10241868 "pdflatex"
"document.lot" 1655035030 4986 06b1b121a2f2db5a8da4c43a2e7db872 "pdflatex"
"document.out" 1655035030 5573 9bd1500b472001dfe82f052359b713f2 "pdflatex"
"document.run.xml" 1655035030 2445 b409c18254f7f5782630d13a05948f21 "pdflatex"
"document.tex" 1654968406 6713 eb3647ce32b19002e48c2c97d8fb2840 ""
"document.toc" 1655035030 9021 e44f14684fee4149c95935d775f09954 "pdflatex"
"images//Portada_Logo.png" 1651111039 22996 c527860321fd85a49ffef78eb664cfb0 ""
"images//ROPcompound.jpg" 1654626518 189399 440667572df7b1c6adea87e1316fdedd ""
"images//aslr_offset.jpg" 1654821383 24380 09a1b8196c0d4095853e0abbc94fde03 ""
@@ -234,6 +236,8 @@
"images//mem_major_page_fault.jpg" 1654345015 34926 900a506f60da0b26c50f0ec9daa9b295 ""
"images//mem_minor_page_fault.jpg" 1654345021 49534 278ecdf64e412a950f4d809dfea89dc9 ""
"images//memory.jpg" 1654594805 26028 033e8d676afa0c083a4f3b90a6784395 ""
"images//rootkit.jpg" 1655000354 177203 7184f9a9a8eab7aa201bf27f112e27e7 ""
"images//rootkit_files.jpg" 1655034484 66866 8e0c6b46084e7abbb184c929f32ee2ee ""
"images//rop_evil_ebpf_1.jpg" 1654690993 80272 893c8a309177ea30436b1cb0e0a4f3ba ""
"images//rop_evil_ebpf_2.jpg" 1654691288 72075 f0114fb8746bb65ea72a81a9679fa908 ""
"images//rop_evil_ebpf_3.jpg" 1654692503 58582 2a0db73e0ff01342847ed343d4f7319b ""
@@ -255,15 +259,15 @@
"images//xdp_diag.jpg" 1653602902 43089 4e9dfc5caf229d9d24a8459475c563f4 ""
"images/cBPF_prog.jpg" 1653294568 37580 becaaa0d8a6a16353948a17c8ecd2bb8 ""
"images/creativecommons.png" 1651111039 20748 2d1005dcab1cdcb889ee17a8f3b8cbcb ""
"pdfa.xmpi" 1654942903 5042 d0c2490e023f3d1613b9dde05d541626 "pdflatex"
"pdfa.xmpi" 1655035061 5042 ecb3d9c8c507cff3a5352640f1a206b5 "pdflatex"
(generated)
"document.lot"
"document.aux"
"document.bcf"
"document.pdf"
"document.toc"
"document.aux"
"document.log"
"document.run.xml"
"document.pdf"
"document.bcf"
"document.lof"
"pdfa.xmpi"
"document.log"
"document.out"
"document.run.xml"
"document.lot"

155
docs/document.fls
View File

@@ -1304,14 +1304,14 @@ INPUT images//cBPF_prog_ex_sol.png
INPUT ./images//cBPF_prog_ex_sol.png
INPUT ./images//cBPF_prog_ex_sol.png
INPUT /usr/share/texlive/texmf-dist/fonts/tfm/public/txfonts/t1xi.tfm
INPUT /usr/share/texlive/texmf-dist/fonts/vf/public/txfonts/t1xi.vf
INPUT /usr/share/texlive/texmf-dist/fonts/tfm/public/txfonts/rtxptmri.tfm
INPUT /usr/share/texlive/texmf-dist/fonts/tfm/public/txfonts/rtxi.tfm
INPUT ./images//ebpf_arch.jpg
INPUT ./images//ebpf_arch.jpg
INPUT images//ebpf_arch.jpg
INPUT ./images//ebpf_arch.jpg
INPUT ./images//ebpf_arch.jpg
INPUT /usr/share/texlive/texmf-dist/fonts/vf/public/txfonts/t1xi.vf
INPUT /usr/share/texlive/texmf-dist/fonts/tfm/public/txfonts/rtxptmri.tfm
INPUT /usr/share/texlive/texmf-dist/fonts/tfm/public/txfonts/rtxi.tfm
INPUT ./images//xdp_diag.jpg
INPUT ./images//xdp_diag.jpg
INPUT images//xdp_diag.jpg
@@ -1368,17 +1368,11 @@ INPUT ./images//stack.jpg
INPUT images//stack.jpg
INPUT ./images//stack.jpg
INPUT ./images//stack.jpg
INPUT ./chapters/chapter3.tex
INPUT ./chapters/chapter3.tex
INPUT ./chapters/chapter3.tex
INPUT ./chapters/chapter3.tex
INPUT ./chapters/chapter3.tex
INPUT chapters/chapter3.tex
INPUT ./chapters/chapter3.tex
INPUT ./chapters/chapter3.tex
INPUT ./chapters/chapter3.tex
INPUT ./chapters/chapter3.tex
INPUT chapters/chapter3.tex
INPUT ./images//stack_ret_hij_simple.jpg
INPUT ./images//stack_ret_hij_simple.jpg
INPUT images//stack_ret_hij_simple.jpg
INPUT ./images//stack_ret_hij_simple.jpg
INPUT ./images//stack_ret_hij_simple.jpg
INPUT /usr/share/texlive/texmf-dist/tex/latex/listings/lstlang1.sty
INPUT /usr/share/texlive/texmf-dist/tex/latex/listings/lstlang1.sty
INPUT /usr/share/texlive/texmf-dist/tex/latex/listings/lstlang1.sty
@@ -1393,47 +1387,6 @@ INPUT /usr/share/texlive/texmf-dist/fonts/tfm/public/txfonts/t1xbtt.tfm
INPUT /usr/share/texlive/texmf-dist/fonts/vf/public/txfonts/t1xr.vf
INPUT /usr/share/texlive/texmf-dist/fonts/tfm/public/txfonts/rtxptmr.tfm
INPUT /usr/share/texlive/texmf-dist/fonts/tfm/public/txfonts/rtxr.tfm
INPUT ./images//stack_scan_write_tech.jpg
INPUT ./images//stack_scan_write_tech.jpg
INPUT images//stack_scan_write_tech.jpg
INPUT ./images//stack_scan_write_tech.jpg
INPUT ./images//stack_scan_write_tech.jpg
INPUT ./images//frame.jpg
INPUT ./images//frame.jpg
INPUT images//frame.jpg
INPUT ./images//frame.jpg
INPUT ./images//frame.jpg
INPUT ./images//tcp_conn.jpg
INPUT ./images//tcp_conn.jpg
INPUT images//tcp_conn.jpg
INPUT ./images//tcp_conn.jpg
INPUT ./images//tcp_conn.jpg
INPUT ./images//tcp_retransmission.jpg
INPUT ./images//tcp_retransmission.jpg
INPUT images//tcp_retransmission.jpg
INPUT ./images//tcp_retransmission.jpg
INPUT ./images//tcp_retransmission.jpg
INPUT ./images//tcp_exfiltrate_retrans.jpg
INPUT ./images//tcp_exfiltrate_retrans.jpg
INPUT images//tcp_exfiltrate_retrans.jpg
INPUT ./images//tcp_exfiltrate_retrans.jpg
INPUT ./images//tcp_exfiltrate_retrans.jpg
INPUT ./chapters/chapter4.tex
INPUT ./chapters/chapter4.tex
INPUT ./chapters/chapter4.tex
INPUT ./chapters/chapter4.tex
INPUT ./chapters/chapter4.tex
INPUT chapters/chapter4.tex
INPUT ./chapters/chapter4.tex
INPUT ./chapters/chapter4.tex
INPUT ./chapters/chapter4.tex
INPUT ./chapters/chapter4.tex
INPUT chapters/chapter4.tex
INPUT ./images//stack_ret_hij_simple.jpg
INPUT ./images//stack_ret_hij_simple.jpg
INPUT images//stack_ret_hij_simple.jpg
INPUT ./images//stack_ret_hij_simple.jpg
INPUT ./images//stack_ret_hij_simple.jpg
INPUT ./images//buffer_overflow.jpg
INPUT ./images//buffer_overflow.jpg
INPUT images//buffer_overflow.jpg
@@ -1449,21 +1402,21 @@ INPUT ./images//ROPcompound.jpg
INPUT images//ROPcompound.jpg
INPUT ./images//ROPcompound.jpg
INPUT ./images//ROPcompound.jpg
INPUT ./images//rop_evil_ebpf_1.jpg
INPUT ./images//rop_evil_ebpf_1.jpg
INPUT images//rop_evil_ebpf_1.jpg
INPUT ./images//rop_evil_ebpf_1.jpg
INPUT ./images//rop_evil_ebpf_1.jpg
INPUT ./images//rop_evil_ebpf_2.jpg
INPUT ./images//rop_evil_ebpf_2.jpg
INPUT images//rop_evil_ebpf_2.jpg
INPUT ./images//rop_evil_ebpf_2.jpg
INPUT ./images//rop_evil_ebpf_2.jpg
INPUT ./images//rop_evil_ebpf_3.jpg
INPUT ./images//rop_evil_ebpf_3.jpg
INPUT images//rop_evil_ebpf_3.jpg
INPUT ./images//rop_evil_ebpf_3.jpg
INPUT ./images//rop_evil_ebpf_3.jpg
INPUT ./images//frame.jpg
INPUT ./images//frame.jpg
INPUT images//frame.jpg
INPUT ./images//frame.jpg
INPUT ./images//frame.jpg
INPUT ./images//tcp_conn.jpg
INPUT ./images//tcp_conn.jpg
INPUT images//tcp_conn.jpg
INPUT ./images//tcp_conn.jpg
INPUT ./images//tcp_conn.jpg
INPUT ./images//tcp_retransmission.jpg
INPUT ./images//tcp_retransmission.jpg
INPUT images//tcp_retransmission.jpg
INPUT ./images//tcp_retransmission.jpg
INPUT ./images//tcp_retransmission.jpg
INPUT ./images//sch_gdb_plt.png
INPUT ./images//sch_gdb_plt.png
INPUT images//sch_gdb_plt.png
@@ -1484,6 +1437,63 @@ INPUT ./images//sch_glibc_func.png
INPUT images//sch_glibc_func.png
INPUT ./images//sch_glibc_func.png
INPUT ./images//sch_glibc_func.png
INPUT ./chapters/chapter3.tex
INPUT ./chapters/chapter3.tex
INPUT ./chapters/chapter3.tex
INPUT ./chapters/chapter3.tex
INPUT ./chapters/chapter3.tex
INPUT chapters/chapter3.tex
INPUT ./chapters/chapter3.tex
INPUT ./chapters/chapter3.tex
INPUT ./chapters/chapter3.tex
INPUT ./chapters/chapter3.tex
INPUT chapters/chapter3.tex
INPUT ./images//stack_scan_write_tech.jpg
INPUT ./images//stack_scan_write_tech.jpg
INPUT images//stack_scan_write_tech.jpg
INPUT ./images//stack_scan_write_tech.jpg
INPUT ./images//stack_scan_write_tech.jpg
INPUT ./images//tcp_exfiltrate_retrans.jpg
INPUT ./images//tcp_exfiltrate_retrans.jpg
INPUT images//tcp_exfiltrate_retrans.jpg
INPUT ./images//tcp_exfiltrate_retrans.jpg
INPUT ./images//tcp_exfiltrate_retrans.jpg
INPUT ./chapters/chapter4.tex
INPUT ./chapters/chapter4.tex
INPUT ./chapters/chapter4.tex
INPUT ./chapters/chapter4.tex
INPUT ./chapters/chapter4.tex
INPUT chapters/chapter4.tex
INPUT ./chapters/chapter4.tex
INPUT ./chapters/chapter4.tex
INPUT ./chapters/chapter4.tex
INPUT ./chapters/chapter4.tex
INPUT chapters/chapter4.tex
INPUT ./images//rootkit.jpg
INPUT ./images//rootkit.jpg
INPUT images//rootkit.jpg
INPUT ./images//rootkit.jpg
INPUT ./images//rootkit.jpg
INPUT ./images//rootkit_files.jpg
INPUT ./images//rootkit_files.jpg
INPUT images//rootkit_files.jpg
INPUT ./images//rootkit_files.jpg
INPUT ./images//rootkit_files.jpg
INPUT ./images//rop_evil_ebpf_1.jpg
INPUT ./images//rop_evil_ebpf_1.jpg
INPUT images//rop_evil_ebpf_1.jpg
INPUT ./images//rop_evil_ebpf_1.jpg
INPUT ./images//rop_evil_ebpf_1.jpg
INPUT ./images//rop_evil_ebpf_2.jpg
INPUT ./images//rop_evil_ebpf_2.jpg
INPUT images//rop_evil_ebpf_2.jpg
INPUT ./images//rop_evil_ebpf_2.jpg
INPUT ./images//rop_evil_ebpf_2.jpg
INPUT ./images//rop_evil_ebpf_3.jpg
INPUT ./images//rop_evil_ebpf_3.jpg
INPUT images//rop_evil_ebpf_3.jpg
INPUT ./images//rop_evil_ebpf_3.jpg
INPUT ./images//rop_evil_ebpf_3.jpg
INPUT ./images//aslr_offset.jpg
INPUT ./images//aslr_offset.jpg
INPUT images//aslr_offset.jpg
@@ -1519,6 +1529,11 @@ INPUT chapters/chapter6.tex
INPUT /usr/share/texlive/texmf-dist/fonts/tfm/public/txfonts/tcxi.tfm
INPUT /usr/share/texlive/texmf-dist/fonts/vf/public/txfonts/tcxi.vf
INPUT /usr/share/texlive/texmf-dist/fonts/tfm/public/txfonts/rtcxi.tfm
INPUT /usr/share/texlive/texmf-dist/fonts/vf/public/txfonts/txmi.vf
INPUT /usr/share/texlive/texmf-dist/fonts/tfm/public/txfonts/rtxmi.tfm
INPUT /usr/share/texlive/texmf-dist/fonts/tfm/public/txfonts/rtxptmri.tfm
INPUT /usr/share/texlive/texmf-dist/fonts/vf/public/txfonts/txmi.vf
INPUT /usr/share/texlive/texmf-dist/fonts/tfm/public/txfonts/rtxmi.tfm
INPUT ./chapters/annex.tex
INPUT ./chapters/annex.tex
INPUT ./chapters/annex.tex

12
docs/document.lof
View File

@@ -71,15 +71,17 @@
\defcounter {refsection}{0}\relax
\contentsline {figure}{\numberline {4.1}{\ignorespaces Overview of the rootkit subsystems and components.\relax }}{65}{figure.caption.60}%
\defcounter {refsection}{0}\relax
\contentsline {figure}{\numberline {4.2}{\ignorespaces Initial setup for the ROP with eBPF technique.\relax }}{66}{figure.caption.61}%
\contentsline {figure}{\numberline {4.2}{\ignorespaces Rootkit programs and scripts.\relax }}{67}{figure.caption.61}%
\defcounter {refsection}{0}\relax
\contentsline {figure}{\numberline {4.3}{\ignorespaces Process memory after syscall exits and ROP code overwrites the stack.\relax }}{67}{figure.caption.62}%
\contentsline {figure}{\numberline {4.3}{\ignorespaces Initial setup for the ROP with eBPF technique.\relax }}{69}{figure.caption.62}%
\defcounter {refsection}{0}\relax
\contentsline {figure}{\numberline {4.4}{\ignorespaces Stack data is restored and program continues its execution.\relax }}{68}{figure.caption.63}%
\contentsline {figure}{\numberline {4.4}{\ignorespaces Process memory after syscall exits and ROP code overwrites the stack.\relax }}{70}{figure.caption.63}%
\defcounter {refsection}{0}\relax
\contentsline {figure}{\numberline {4.5}{\ignorespaces Two runs of the same executable using ASLR, showing a library and two symbols.\relax }}{69}{figure.caption.64}%
\contentsline {figure}{\numberline {4.5}{\ignorespaces Stack data is restored and program continues its execution.\relax }}{71}{figure.caption.64}%
\defcounter {refsection}{0}\relax
\contentsline {figure}{\numberline {4.6}{\ignorespaces Call to the glibc function, using objdump\relax }}{71}{figure.caption.65}%
\contentsline {figure}{\numberline {4.6}{\ignorespaces Two runs of the same executable using ASLR, showing a library and two symbols.\relax }}{72}{figure.caption.65}%
\defcounter {refsection}{0}\relax
\contentsline {figure}{\numberline {4.7}{\ignorespaces Call to the glibc function, using objdump\relax }}{74}{figure.caption.66}%
\defcounter {refsection}{0}\relax
\addvspace {10\p@ }
\defcounter {refsection}{0}\relax

172
docs/document.log
View File

@@ -1,4 +1,4 @@
This is pdfTeX, Version 3.14159265-2.6-1.40.21 (TeX Live 2020/Debian) (preloaded format=pdflatex 2022.4.27) 11 JUN 2022 22:19
This is pdfTeX, Version 3.14159265-2.6-1.40.21 (TeX Live 2020/Debian) (preloaded format=pdflatex 2022.4.27) 12 JUN 2022 08:16
entering extended mode
restricted \write18 enabled.
%&-line parsing enabled.
@@ -1210,7 +1210,7 @@ Overfull \hbox (0.50073pt too wide) in paragraph at lines 43--44
[3]) (./chapters/chapter2.tex [4]
Chapter 2.
<images//classic_bpf.jpg, id=736, 588.1975pt x 432.61626pt>
<images//classic_bpf.jpg, id=738, 588.1975pt x 432.61626pt>
File: images//classic_bpf.jpg Graphic file (type jpg)
<use images//classic_bpf.jpg>
Package pdftex.def Info: images//classic_bpf.jpg used on input line 20.
@@ -1218,35 +1218,35 @@ Package pdftex.def Info: images//classic_bpf.jpg used on input line 20.
[5
] [6 <./images//classic_bpf.jpg>]
<images//cbpf_prog.jpg, id=757, 403.5075pt x 451.6875pt>
<images//cbpf_prog.jpg, id=759, 403.5075pt x 451.6875pt>
File: images//cbpf_prog.jpg Graphic file (type jpg)
<use images//cbpf_prog.jpg>
Package pdftex.def Info: images//cbpf_prog.jpg used on input line 55.
(pdftex.def) Requested size: 227.62204pt x 254.80415pt.
[7 <./images/cBPF_prog.jpg>]
<images//bpf_instructions.png, id=769, 380.92313pt x 475.27562pt>
<images//bpf_instructions.png, id=771, 380.92313pt x 475.27562pt>
File: images//bpf_instructions.png Graphic file (type png)
<use images//bpf_instructions.png>
Package pdftex.def Info: images//bpf_instructions.png used on input line 96.
(pdftex.def) Requested size: 227.62204pt x 283.99998pt.
<images//bpf_address_mode.png, id=773, 417.05812pt x 313.67188pt>
<images//bpf_address_mode.png, id=775, 417.05812pt x 313.67188pt>
File: images//bpf_address_mode.png Graphic file (type png)
<use images//bpf_address_mode.png>
Package pdftex.def Info: images//bpf_address_mode.png used on input line 105.
(pdftex.def) Requested size: 227.62204pt x 171.19905pt.
[8] [9 <./images//bpf_instructions.png> <./images//bpf_address_mode.png>]
<images//tcpdump_example.png, id=788, 534.99875pt x 454.69875pt>
<images//tcpdump_example.png, id=790, 534.99875pt x 454.69875pt>
File: images//tcpdump_example.png Graphic file (type png)
<use images//tcpdump_example.png>
Package pdftex.def Info: images//tcpdump_example.png used on input line 117.
(pdftex.def) Requested size: 284.52756pt x 241.82869pt.
<images//cBPF_prog_ex_sol.png, id=791, 242.9075pt x 321.2pt>
<images//cBPF_prog_ex_sol.png, id=793, 242.9075pt x 321.2pt>
File: images//cBPF_prog_ex_sol.png Graphic file (type png)
<use images//cBPF_prog_ex_sol.png>
Package pdftex.def Info: images//cBPF_prog_ex_sol.png used on input line 128.
(pdftex.def) Requested size: 170.71652pt x 225.74026pt.
[10 <./images//tcpdump_example.png>]
<images//ebpf_arch.jpg, id=804, 739.76375pt x 472.76625pt>
<images//ebpf_arch.jpg, id=806, 739.76375pt x 472.76625pt>
File: images//ebpf_arch.jpg Graphic file (type jpg)
<use images//ebpf_arch.jpg>
Package pdftex.def Info: images//ebpf_arch.jpg used on input line 167.
@@ -1282,7 +1282,7 @@ Overfull \hbox (13.5802pt too wide) in paragraph at lines 351--381
[]
[17]
<images//xdp_diag.jpg, id=895, 649.42625pt x 472.76625pt>
<images//xdp_diag.jpg, id=897, 649.42625pt x 472.76625pt>
File: images//xdp_diag.jpg Graphic file (type jpg)
<use images//xdp_diag.jpg>
Package pdftex.def Info: images//xdp_diag.jpg used on input line 404.
@@ -1293,7 +1293,7 @@ Overfull \hbox (5.80417pt too wide) in paragraph at lines 460--472
[]
[20] [21] [22] [23]
<images//libbpf_prog.jpg, id=951, 543.02875pt x 502.87875pt>
<images//libbpf_prog.jpg, id=953, 543.02875pt x 502.87875pt>
File: images//libbpf_prog.jpg Graphic file (type jpg)
<use images//libbpf_prog.jpg>
Package pdftex.def Info: images//libbpf_prog.jpg used on input line 570.
@@ -1320,25 +1320,25 @@ BPF and CAP_NET_ADMIN,
[]
[26] [27]
<images//mem_arch_pages.jpg, id=1000, 593.21625pt x 434.62375pt>
<images//mem_arch_pages.jpg, id=1002, 593.21625pt x 434.62375pt>
File: images//mem_arch_pages.jpg Graphic file (type jpg)
<use images//mem_arch_pages.jpg>
Package pdftex.def Info: images//mem_arch_pages.jpg used on input line 709.
(pdftex.def) Requested size: 369.88582pt x 271.00914pt.
[28 <./images//mem_arch_pages.jpg>]
<images//mem_major_page_fault.jpg, id=1008, 639.38875pt x 425.59pt>
<images//mem_major_page_fault.jpg, id=1010, 639.38875pt x 425.59pt>
File: images//mem_major_page_fault.jpg Graphic file (type jpg)
<use images//mem_major_page_fault.jpg>
Package pdftex.def Info: images//mem_major_page_fault.jpg used on input line 7
19.
(pdftex.def) Requested size: 312.9803pt x 208.32661pt.
<images//mem_minor_page_fault.jpg, id=1010, 654.445pt x 555.07375pt>
<images//mem_minor_page_fault.jpg, id=1012, 654.445pt x 555.07375pt>
File: images//mem_minor_page_fault.jpg Graphic file (type jpg)
<use images//mem_minor_page_fault.jpg>
Package pdftex.def Info: images//mem_minor_page_fault.jpg used on input line 7
27.
(pdftex.def) Requested size: 312.9803pt x 265.45834pt.
<images//memory.jpg, id=1012, 310.15875pt x 569.12625pt>
<images//memory.jpg, id=1014, 310.15875pt x 569.12625pt>
File: images//memory.jpg Graphic file (type jpg)
<use images//memory.jpg>
Package pdftex.def Info: images//memory.jpg used on input line 738.
@@ -1351,13 +1351,13 @@ buted within a pro-cess in the x86_64
[29 <./images//mem_major_page_fault.jpg>] [30 <./images//mem_minor_page_fault.j
pg> <./images//memory.jpg>]
<images//stack_pres.jpg, id=1025, 707.64375pt x 283.0575pt>
<images//stack_pres.jpg, id=1027, 707.64375pt x 283.0575pt>
File: images//stack_pres.jpg Graphic file (type jpg)
<use images//stack_pres.jpg>
Package pdftex.def Info: images//stack_pres.jpg used on input line 760.
(pdftex.def) Requested size: 398.33858pt x 159.33606pt.
[31 <./images//stack_pres.jpg>]
<images//stack_ops.jpg, id=1036, 524.96124pt x 694.595pt>
<images//stack_ops.jpg, id=1038, 524.96124pt x 694.595pt>
File: images//stack_ops.jpg Graphic file (type jpg)
<use images//stack_ops.jpg>
Package pdftex.def Info: images//stack_ops.jpg used on input line 794.
@@ -1368,19 +1368,19 @@ LaTeX Font Info: Trying to load font information for T1+txtt on input line 8
(/usr/share/texlive/texmf-dist/tex/latex/txfonts/t1txtt.fd
File: t1txtt.fd 2000/12/15 v3.1
)
<images//stack_before.jpg, id=1039, 712.6625pt x 315.1775pt>
<images//stack_before.jpg, id=1041, 712.6625pt x 315.1775pt>
File: images//stack_before.jpg Graphic file (type jpg)
<use images//stack_before.jpg>
Package pdftex.def Info: images//stack_before.jpg used on input line 804.
(pdftex.def) Requested size: 398.33858pt x 176.16635pt.
<images//stack.jpg, id=1040, 707.64375pt x 381.425pt>
<images//stack.jpg, id=1042, 707.64375pt x 381.425pt>
File: images//stack.jpg Graphic file (type jpg)
<use images//stack.jpg>
Package pdftex.def Info: images//stack.jpg used on input line 811.
(pdftex.def) Requested size: 398.33858pt x 214.70816pt.
[32] [33 <./images//stack_ops.jpg> <./images//stack_before.jpg>] [34 <./images
//stack.jpg>]
<images//stack_ret_hij_simple.jpg, id=1076, 774.895pt x 674.52pt>
<images//stack_ret_hij_simple.jpg, id=1078, 774.895pt x 674.52pt>
File: images//stack_ret_hij_simple.jpg Graphic file (type jpg)
<use images//stack_ret_hij_simple.jpg>
Package pdftex.def Info: images//stack_ret_hij_simple.jpg used on input line 8
@@ -1398,12 +1398,12 @@ nput line 863.
LaTeX Font Info: Font shape `T1/txtt/b/n' in size <10> not available
(Font) Font shape `T1/txtt/bx/n' tried instead on input line 864.
[35] [36 <./images//stack_ret_hij_simple.jpg>]
<images//buffer_overflow.jpg, id=1097, 707.64375pt x 343.2825pt>
<images//buffer_overflow.jpg, id=1099, 707.64375pt x 343.2825pt>
File: images//buffer_overflow.jpg Graphic file (type jpg)
<use images//buffer_overflow.jpg>
Package pdftex.def Info: images//buffer_overflow.jpg used on input line 879.
(pdftex.def) Requested size: 426.79134pt x 207.03964pt.
<images//buffer_overflow_shellcode.jpg, id=1099, 707.64375pt x 379.4175pt>
<images//buffer_overflow_shellcode.jpg, id=1101, 707.64375pt x 379.4175pt>
File: images//buffer_overflow_shellcode.jpg Graphic file (type jpg)
<use images//buffer_overflow_shellcode.jpg>
Package pdftex.def Info: images//buffer_overflow_shellcode.jpg used on input l
@@ -1419,7 +1419,7 @@ LaTeX Warning: Reference `TODO probably an Annex' on page 37 undefined on input
LaTeX Warning: Reference `TODO' on page 38 undefined on input line 907.
[38 <./images//buffer_overflow_shellcode.jpg>]
<images//ROPcompound.jpg, id=1115, 1296.845pt x 790.955pt>
<images//ROPcompound.jpg, id=1117, 1296.845pt x 790.955pt>
File: images//ROPcompound.jpg Graphic file (type jpg)
<use images//ROPcompound.jpg>
Package pdftex.def Info: images//ROPcompound.jpg used on input line 929.
@@ -1434,13 +1434,13 @@ Overfull \hbox (28.45273pt too wide) in paragraph at lines 929--930
LaTeX Warning: Reference `TODO' on page 40 undefined on input line 941.
[40 <./images//ROPcompound.jpg>]
<images//frame.jpg, id=1135, 695.59875pt x 705.63625pt>
<images//frame.jpg, id=1137, 695.59875pt x 705.63625pt>
File: images//frame.jpg Graphic file (type jpg)
<use images//frame.jpg>
Package pdftex.def Info: images//frame.jpg used on input line 954.
(pdftex.def) Requested size: 398.33858pt x 404.07954pt.
[41 <./images//frame.jpg>]
<images//tcp_conn.jpg, id=1150, 452.69125pt x 405.515pt>
<images//tcp_conn.jpg, id=1152, 452.69125pt x 405.515pt>
File: images//tcp_conn.jpg Graphic file (type jpg)
<use images//tcp_conn.jpg>
Package pdftex.def Info: images//tcp_conn.jpg used on input line 1002.
@@ -1452,7 +1452,7 @@ e-quence of SYN, SYN+ACK,
[]
[42] [43 <./images//tcp_conn.jpg>]
<images//tcp_retransmission.jpg, id=1164, 523.9575pt x 485.815pt>
<images//tcp_retransmission.jpg, id=1166, 523.9575pt x 485.815pt>
File: images//tcp_retransmission.jpg Graphic file (type jpg)
<use images//tcp_retransmission.jpg>
Package pdftex.def Info: images//tcp_retransmission.jpg used on input line 101
@@ -1483,7 +1483,7 @@ s a call to the func-tion timerfd_settime,
[]
[45] [46]
<images//sch_gdb_plt.png, id=1194, 1040.88875pt x 146.5475pt>
<images//sch_gdb_plt.png, id=1196, 1040.88875pt x 146.5475pt>
File: images//sch_gdb_plt.png Graphic file (type png)
<use images//sch_gdb_plt.png>
Package pdftex.def Info: images//sch_gdb_plt.png used on input line 1100.
@@ -1493,7 +1493,7 @@ Overfull \hbox (14.22636pt too wide) in paragraph at lines 1100--1101
[][]
[]
<images//sch_gdb_got_prev.png, id=1195, 529.98pt x 39.14626pt>
<images//sch_gdb_got_prev.png, id=1197, 529.98pt x 39.14626pt>
File: images//sch_gdb_got_prev.png Graphic file (type png)
<use images//sch_gdb_got_prev.png>
Package pdftex.def Info: images//sch_gdb_got_prev.png used on input line 1107.
@@ -1504,7 +1504,7 @@ Overfull \hbox (14.22636pt too wide) in paragraph at lines 1107--1108
[][]
[]
<images//sch_gdb_got_after.png, id=1199, 532.99126pt x 41.15375pt>
<images//sch_gdb_got_after.png, id=1201, 532.99126pt x 41.15375pt>
File: images//sch_gdb_got_after.png Graphic file (type png)
<use images//sch_gdb_got_after.png>
Package pdftex.def Info: images//sch_gdb_got_after.png used on input line 1116
@@ -1515,7 +1515,7 @@ Overfull \hbox (14.22636pt too wide) in paragraph at lines 1116--1117
[][]
[]
<images//sch_glibc_func.png, id=1200, 585.18625pt x 89.33376pt>
<images//sch_glibc_func.png, id=1202, 585.18625pt x 89.33376pt>
File: images//sch_glibc_func.png Graphic file (type png)
<use images//sch_glibc_func.png>
Package pdftex.def Info: images//sch_glibc_func.png used on input line 1123.
@@ -1566,7 +1566,7 @@ Overfull \hbox (3.09538pt too wide) in paragraph at lines 252--253
[]
[57]
<images//stack_scan_write_tech.jpg, id=1383, 829.0975pt x 315.1775pt>
<images//stack_scan_write_tech.jpg, id=1385, 829.0975pt x 315.1775pt>
File: images//stack_scan_write_tech.jpg Graphic file (type jpg)
<use images//stack_scan_write_tech.jpg>
Package pdftex.def Info: images//stack_scan_write_tech.jpg used on input line
@@ -1582,7 +1582,7 @@ Overfull \hbox (28.45273pt too wide) in paragraph at lines 268--269
LaTeX Warning: Reference `TODO' on page 59 undefined on input line 290.
[59] [60] [61]
<images//tcp_exfiltrate_retrans.jpg, id=1436, 633.36626pt x 475.7775pt>
<images//tcp_exfiltrate_retrans.jpg, id=1438, 633.36626pt x 475.7775pt>
File: images//tcp_exfiltrate_retrans.jpg Graphic file (type jpg)
<use images//tcp_exfiltrate_retrans.jpg>
Package pdftex.def Info: images//tcp_exfiltrate_retrans.jpg used on input line
@@ -1591,82 +1591,96 @@ Package pdftex.def Info: images//tcp_exfiltrate_retrans.jpg used on input line
[62 <./images//tcp_exfiltrate_retrans.jpg>])
(./chapters/chapter4.tex [63]
Chapter 4.
<images//rootkit.jpg, id=1445, 886.31125pt x 614.295pt>
<images//rootkit.jpg, id=1448, 886.31125pt x 614.295pt>
File: images//rootkit.jpg Graphic file (type jpg)
<use images//rootkit.jpg>
Package pdftex.def Info: images//rootkit.jpg used on input line 19.
Package pdftex.def Info: images//rootkit.jpg used on input line 21.
(pdftex.def) Requested size: 441.01772pt x 305.67511pt.
Overfull \hbox (14.22636pt too wide) in paragraph at lines 19--20
Overfull \hbox (14.22636pt too wide) in paragraph at lines 21--22
[][]
[]
[64
]
] [65 <./images//rootkit.jpg>] [66]
<images//rootkit_files.jpg, id=1464, 568.1225pt x 462.72874pt>
File: images//rootkit_files.jpg Graphic file (type jpg)
<use images//rootkit_files.jpg>
Package pdftex.def Info: images//rootkit_files.jpg used on input line 58.
(pdftex.def) Requested size: 426.79134pt x 347.63174pt.
LaTeX Font Info: Font shape `T1/txr/b/it' in size <12> not available
(Font) Font shape `T1/txr/bx/it' tried instead on input line 65.
LaTeX Warning: Reference `TODO EVALUATION' on page 65 undefined on input line 3
0.
Overfull \hbox (11.29134pt too wide) in paragraph at lines 65--66
[]\T1/txr/m/n/12 The pro-gram \T1/txr/bx/it/12 in-jec-tor \T1/txr/m/n/12 com-pr
ises the rootkit client and the shared li-brary RawTCP_Lib.
[]
<images//rop_evil_ebpf_1.jpg, id=1455, 789.95125pt x 395.4775pt>
[67 <./images//rootkit_files.jpg>]
LaTeX Warning: Reference `TODO EVALUATION' on page 68 undefined on input line 8
4.
<images//rop_evil_ebpf_1.jpg, id=1476, 789.95125pt x 395.4775pt>
File: images//rop_evil_ebpf_1.jpg Graphic file (type jpg)
<use images//rop_evil_ebpf_1.jpg>
Package pdftex.def Info: images//rop_evil_ebpf_1.jpg used on input line 38.
Package pdftex.def Info: images//rop_evil_ebpf_1.jpg used on input line 92.
(pdftex.def) Requested size: 426.79134pt x 213.66933pt.
[65 <./images//rootkit.jpg>]
[68]
LaTeX Warning: Reference `TODO' on page 66 undefined on input line 46.
LaTeX Warning: Reference `TODO' on page 69 undefined on input line 100.
[66 <./images//rop_evil_ebpf_1.jpg>]
Overfull \hbox (4.42868pt too wide) in paragraph at lines 55--56
[69 <./images//rop_evil_ebpf_1.jpg>]
Overfull \hbox (4.42868pt too wide) in paragraph at lines 109--110
\T1/txr/m/n/12 the orig-i-nal data later) and we pro-ceed to over-write the sta
ck us-ing bpf_probe_write_user(),
[]
<images//rop_evil_ebpf_2.jpg, id=1472, 789.95125pt x 395.4775pt>
<images//rop_evil_ebpf_2.jpg, id=1492, 789.95125pt x 395.4775pt>
File: images//rop_evil_ebpf_2.jpg Graphic file (type jpg)
<use images//rop_evil_ebpf_2.jpg>
Package pdftex.def Info: images//rop_evil_ebpf_2.jpg used on input line 59.
Package pdftex.def Info: images//rop_evil_ebpf_2.jpg used on input line 113.
(pdftex.def) Requested size: 426.79134pt x 213.66933pt.
<images//rop_evil_ebpf_3.jpg, id=1475, 789.95125pt x 369.38pt>
<images//rop_evil_ebpf_3.jpg, id=1495, 789.95125pt x 369.38pt>
File: images//rop_evil_ebpf_3.jpg Graphic file (type jpg)
<use images//rop_evil_ebpf_3.jpg>
Package pdftex.def Info: images//rop_evil_ebpf_3.jpg used on input line 70.
Package pdftex.def Info: images//rop_evil_ebpf_3.jpg used on input line 124.
(pdftex.def) Requested size: 426.79134pt x 199.5693pt.
[67 <./images//rop_evil_ebpf_2.jpg>] [68 <./images//rop_evil_ebpf_3.jpg>]
[70 <./images//rop_evil_ebpf_2.jpg>] [71 <./images//rop_evil_ebpf_3.jpg>]
LaTeX Warning: Reference `table:aslr_offset' on page 69 undefined on input line
93.
LaTeX Warning: Reference `table:aslr_offset' on page 72 undefined on input line
147.
<images//aslr_offset.jpg, id=1489, 597.23125pt x 273.02pt>
<images//aslr_offset.jpg, id=1509, 597.23125pt x 273.02pt>
File: images//aslr_offset.jpg Graphic file (type jpg)
<use images//aslr_offset.jpg>
Package pdftex.def Info: images//aslr_offset.jpg used on input line 98.
Package pdftex.def Info: images//aslr_offset.jpg used on input line 152.
(pdftex.def) Requested size: 369.88582pt x 169.0915pt.
[69 <./images//aslr_offset.jpg>]
Overfull \hbox (0.26146pt too wide) in paragraph at lines 121--122
[72 <./images//aslr_offset.jpg>]
Overfull \hbox (0.26146pt too wide) in paragraph at lines 175--176
[]\T1/txr/m/n/12 This tech-nique works both in com-pil-ers with low hard-en-ing
fe-tau-res by de-fault (Clang)
[]
Overfull \hbox (38.05193pt too wide) in paragraph at lines 125--127
Overfull \hbox (38.05193pt too wide) in paragraph at lines 179--181
\T1/txr/m/n/12 We load and at-tach a tra-ce-point eBPF pro-gram at the \T1/txr/
m/it/12 en-ter \T1/txr/m/n/12 po-si-tion of syscall sys_timerfd_settime.
[]
<images//sch_firstcall.png, id=1501, 643.40375pt x 91.34125pt>
<images//sch_firstcall.png, id=1521, 643.40375pt x 91.34125pt>
File: images//sch_firstcall.png Graphic file (type png)
<use images//sch_firstcall.png>
Package pdftex.def Info: images//sch_firstcall.png used on input line 135.
Package pdftex.def Info: images//sch_firstcall.png used on input line 189.
(pdftex.def) Requested size: 369.88582pt x 52.51244pt.
[70]) (./chapters/chapter5.tex [71 <./images//sch_firstcall.png>]
[73]) (./chapters/chapter5.tex [74 <./images//sch_firstcall.png>]
Chapter 5.
) (./chapters/chapter6.tex [72
) (./chapters/chapter6.tex [75
]
Chapter 6.
) [73
) [76
]
Overfull \hbox (5.34976pt too wide) in paragraph at lines 338--338
@@ -1674,7 +1688,7 @@ Overfull \hbox (5.34976pt too wide) in paragraph at lines 338--338
/ yir -[] cyber -[] threats -[]
[]
[74
[77
]
@@ -1695,7 +1709,7 @@ Overfull \hbox (21.24973pt too wide) in paragraph at lines 338--338
mmit _ 2015feb20 .
[]
[75]
[78]
Overfull \hbox (9.14975pt too wide) in paragraph at lines 338--338
\T1/txtt/m/n/12 ch02 . xhtml# :-[]: text = With % 20JIT % 20compiled % 20code %
2C % 20i ,[] %20other %
@@ -1707,7 +1721,7 @@ Overfull \hbox (6.49615pt too wide) in paragraph at lines 338--338
022), [On-line]. Avail-able: [][]$\T1/txtt/m/n/12 https :
[]
[76]
[79]
Overfull \hbox (0.76683pt too wide) in paragraph at lines 338--338
[]\T1/txr/m/n/12 ^^P Bpf next ker-nel tree.^^Q (), [On-line]. Avail-able: [][]
$\T1/txtt/m/n/12 https : / / kernel . googlesource .
@@ -1719,7 +1733,7 @@ Overfull \hbox (14.49278pt too wide) in paragraph at lines 338--338
12 . [On-line]. Avail-able: [][]$\T1/txtt/m/n/12 http : / / manpages .
[]
[77]
[80]
Overfull \hbox (9.33742pt too wide) in paragraph at lines 338--338
\T1/txr/m/n/12 Avail-able: [][]$\T1/txtt/m/n/12 https : / / events19 . linuxfou
ndation . org / wp -[] content / uploads /
@@ -1767,7 +1781,7 @@ Overfull \hbox (4.29944pt too wide) in paragraph at lines 338--338
2), [On-line]. Avail-able: [][]$\T1/txtt/m/n/12 https :
[]
[78]
[81]
Overfull \hbox (6.53491pt too wide) in paragraph at lines 338--338
[]\T1/txr/m/n/12 H. Sidh-pur-wala. ^^P Hard-en-ing elf bi-na-ries us-ing re-lo
-ca-tion read-only (relro).^^Q (Jan. 28,
@@ -1797,7 +1811,7 @@ Overfull \hbox (39.98859pt too wide) in paragraph at lines 338--338
il-able: [][]$\T1/txtt/m/n/12 https : / / raw . githubusercontent .
[]
[79] (./chapters/annex.tex [80]
[82] (./chapters/annex.tex [83]
(/usr/share/texlive/texmf-dist/tex/latex/listings/lstlang1.sty
File: lstlang1.sty 2020/03/24 1.8d listings language file
)
@@ -1822,9 +1836,6 @@ l.346 \end{document}
LaTeX Warning: There were undefined references.
LaTeX Warning: Label(s) may have changed. Rerun to get cross-references right.
Package rerunfilecheck Info: File `document.out' has not changed.
(rerunfilecheck) Checksum: 9BD1500B472001DFE82F052359B713F2;5573.
Package logreq Info: Writing requests to 'document.run.xml'.
@@ -1832,11 +1843,11 @@ Package logreq Info: Writing requests to 'document.run.xml'.
)
Here is how much of TeX's memory you used:
29206 strings out of 481209
465378 string characters out of 5914747
1628288 words of memory out of 5000000
45111 multiletter control sequences out of 15000+600000
459242 words of font info for 106 fonts, out of 8000000 for 9000
29225 strings out of 481209
465746 string characters out of 5914747
1630185 words of memory out of 5000000
45121 multiletter control sequences out of 15000+600000
462257 words of font info for 109 fonts, out of 8000000 for 9000
36 hyphenation exceptions out of 8191
88i,12n,90p,1029b,3721s stack positions out of 5000i,500n,10000p,200000b,80000s
{/usr/share/texlive/texmf-dist/fonts/enc/dvips/base/8r.enc}</usr/share/texliv
@@ -1849,11 +1860,12 @@ hare/texlive/texmf-dist/fonts/type1/public/txfonts/t1xtt.pfb></usr/share/texliv
e/texmf-dist/fonts/type1/urw/helvetic/uhvb8a.pfb></usr/share/texlive/texmf-dist
/fonts/type1/urw/helvetic/uhvr8a.pfb></usr/share/texlive/texmf-dist/fonts/type1
/urw/helvetic/uhvr8a.pfb></usr/share/texlive/texmf-dist/fonts/type1/urw/times/u
tmb8a.pfb></usr/share/texlive/texmf-dist/fonts/type1/urw/times/utmr8a.pfb></usr
/share/texlive/texmf-dist/fonts/type1/urw/times/utmri8a.pfb>
Output written on document.pdf (101 pages, 2400365 bytes).
tmb8a.pfb></usr/share/texlive/texmf-dist/fonts/type1/urw/times/utmbi8a.pfb></us
r/share/texlive/texmf-dist/fonts/type1/urw/times/utmr8a.pfb></usr/share/texlive
/texmf-dist/fonts/type1/urw/times/utmri8a.pfb>
Output written on document.pdf (104 pages, 2487727 bytes).
PDF statistics:
2008 PDF objects out of 2073 (max. 8388607)
549 named destinations out of 1000 (max. 500000)
787 words of extra memory for PDF output out of 10000 (max. 10000000)
2036 PDF objects out of 2073 (max. 8388607)
554 named destinations out of 1000 (max. 500000)
792 words of extra memory for PDF output out of 10000 (max. 10000000)

BIN
docs/document.pdf
View File

Binary file not shown.

BIN
docs/document.synctex.gz
View File

Binary file not shown.

18
docs/document.toc
View File

@@ -129,21 +129,21 @@
\defcounter {refsection}{0}\relax
\contentsline {section}{\numberline {4.1}Rootkit architecture}{64}{section.4.1}%
\defcounter {refsection}{0}\relax
\contentsline {section}{\numberline {4.2}Library injection attacks}{64}{section.4.2}%
\contentsline {section}{\numberline {4.2}Library injection attacks}{68}{section.4.2}%
\defcounter {refsection}{0}\relax
\contentsline {subsection}{\numberline {4.2.1}ROP with eBPF}{65}{subsection.4.2.1}%
\contentsline {subsection}{\numberline {4.2.1}ROP with eBPF}{68}{subsection.4.2.1}%
\defcounter {refsection}{0}\relax
\contentsline {subsection}{\numberline {4.2.2}Bypassing hardening features in ELFs}{68}{subsection.4.2.2}%
\contentsline {subsection}{\numberline {4.2.2}Bypassing hardening features in ELFs}{71}{subsection.4.2.2}%
\defcounter {refsection}{0}\relax
\contentsline {subsection}{\numberline {4.2.3}Library injection via GOT hijacking}{70}{subsection.4.2.3}%
\contentsline {subsection}{\numberline {4.2.3}Library injection via GOT hijacking}{73}{subsection.4.2.3}%
\defcounter {refsection}{0}\relax
\contentsline {chapter}{\numberline {5}Evaluation}{72}{chapter.5}%
\contentsline {chapter}{\numberline {5}Evaluation}{75}{chapter.5}%
\defcounter {refsection}{0}\relax
\contentsline {section}{\numberline {5.1}Developed capabilities}{72}{section.5.1}%
\contentsline {section}{\numberline {5.1}Developed capabilities}{75}{section.5.1}%
\defcounter {refsection}{0}\relax
\contentsline {section}{\numberline {5.2}Rootkit use cases}{72}{section.5.2}%
\contentsline {section}{\numberline {5.2}Rootkit use cases}{75}{section.5.2}%
\defcounter {refsection}{0}\relax
\contentsline {chapter}{\numberline {6}Related work}{73}{chapter.6}%
\contentsline {chapter}{\numberline {6}Related work}{76}{chapter.6}%
\defcounter {refsection}{0}\relax
\contentsline {chapter}{Bibliography}{74}{chapter.6}%
\contentsline {chapter}{Bibliography}{77}{chapter.6}%
\contentsfinish

BIN
docs/images/rootkit_files.jpg Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 65 KiB

8
docs/pdfa.xmpi
View File

@@ -73,15 +73,15 @@
</rdf:Description>
<rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/">
<xmp:CreatorTool>LaTeX with hyperref</xmp:CreatorTool>
<xmp:ModifyDate>2022-06-11T22:19:38-04:00</xmp:ModifyDate>
<xmp:CreateDate>2022-06-11T22:19:38-04:00</xmp:CreateDate>
<xmp:MetadataDate>2022-06-11T22:19:38-04:00</xmp:MetadataDate>
<xmp:ModifyDate>2022-06-12T08:16:18-04:00</xmp:ModifyDate>
<xmp:CreateDate>2022-06-12T08:16:18-04:00</xmp:CreateDate>
<xmp:MetadataDate>2022-06-12T08:16:18-04:00</xmp:MetadataDate>
</rdf:Description>
<rdf:Description rdf:about="" xmlns:xmpRights = "http://ns.adobe.com/xap/1.0/rights/">
</rdf:Description>
<rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/">
<xmpMM:DocumentID>uuid:467B87E0-A1EA-A037-7CB7-0477245DEBC3</xmpMM:DocumentID>
<xmpMM:InstanceID>uuid:7F2D8D22-B1AD-408D-E1B3-D60EC0C03D95</xmpMM:InstanceID>
<xmpMM:InstanceID>uuid:29ACEC5C-F7CF-8E95-D28B-D8648FF96039</xmpMM:InstanceID>
</rdf:Description>
</rdf:RDF>
</x:xmpmeta>