Continued with offensive capabilities, incorporated security features and started with tracing program features

This commit is contained in:
h3xduck
2022-06-02 19:00:10 -04:00
parent 5d5aafb46d
commit 2c3648a18a
16 changed files with 882 additions and 203 deletions

View File

@@ -1,4 +1,4 @@
This is pdfTeX, Version 3.14159265-2.6-1.40.21 (TeX Live 2020/Debian) (preloaded format=pdflatex 2022.4.27) 28 MAY 2022 09:22
This is pdfTeX, Version 3.14159265-2.6-1.40.21 (TeX Live 2020/Debian) (preloaded format=pdflatex 2022.4.27) 2 JUN 2022 18:58
entering extended mode
restricted \write18 enabled.
%&-line parsing enabled.
@@ -1079,14 +1079,7 @@ Package: blx-case-expl3 2020/12/31 v3.16 expl3 case changing code for biblatex
Package biblatex Info: Trying to load bibliographic data...
Package biblatex Info: ... file 'document.bbl' found.
(./document.bbl
Package biblatex Warning: Biber reported the following issues
(biblatex) with 'ebpf_bounded_loops':
(biblatex) - Entry 'ebpf_bounded_loops' (bibliography/bibliograp
hy.bib): Invalid format '2019-06-31' of date field 'date' - ignoring.
)
(./document.bbl)
Package biblatex Info: Reference section=0 on input line 179.
Package biblatex Info: Reference segment=0 on input line 179.
LaTeX Font Info: Trying to load font information for T1+txss on input line 1
@@ -1096,7 +1089,7 @@ File: t1txss.fd 2000/12/15 v3.1
)
LaTeX Font Info: Font shape `T1/txss/m/n' will be
(Font) scaled to size 11.39996pt on input line 186.
<images//Portada_Logo.png, id=149, 456.2865pt x 45.99pt>
<images//Portada_Logo.png, id=181, 456.2865pt x 45.99pt>
File: images//Portada_Logo.png Graphic file (type png)
<use images//Portada_Logo.png>
Package pdftex.def Info: images//Portada_Logo.png used on input line 190.
@@ -1109,7 +1102,7 @@ LaTeX Font Info: Font shape `T1/txss/m/n' will be
(Font) scaled to size 23.63593pt on input line 201.
LaTeX Font Info: Font shape `T1/txss/m/n' will be
(Font) scaled to size 19.70294pt on input line 205.
<images/creativecommons.png, id=151, 338.76563pt x 118.19156pt>
<images/creativecommons.png, id=183, 338.76563pt x 118.19156pt>
File: images/creativecommons.png Graphic file (type png)
<use images/creativecommons.png>
Package pdftex.def Info: images/creativecommons.png used on input line 215.
@@ -1118,7 +1111,8 @@ LaTeX Font Info: Font shape `T1/txss/b/n' in size <12> not available
(Font) Font shape `T1/txss/bx/n' tried instead on input line 216.
LaTeX Font Info: Font shape `T1/txss/bx/n' will be
(Font) scaled to size 11.39996pt on input line 216.
[1
[1
<./images//Portada_Logo.png> <./images/creativecommons.png>]pdfTeX warning (ex
t4): destination with the same identifier (name{page.i}) has been already used,
@@ -1199,7 +1193,7 @@ File: utxsyc.fd 2000/12/15 v3.1
[12
] [13]
] [13] [14]
Chapter 1.
LaTeX Font Info: Trying to load font information for TS1+txr on input line 3
30.
@@ -1220,7 +1214,7 @@ Chapter 2.
LaTeX Warning: Reference `section:analysis_offensive_capabilities' on page 5 un
defined on input line 412.
<images//classic_bpf.jpg, id=428, 588.1975pt x 432.61626pt>
<images//classic_bpf.jpg, id=491, 588.1975pt x 432.61626pt>
File: images//classic_bpf.jpg Graphic file (type jpg)
<use images//classic_bpf.jpg>
Package pdftex.def Info: images//classic_bpf.jpg used on input line 426.
@@ -1228,36 +1222,36 @@ Package pdftex.def Info: images//classic_bpf.jpg used on input line 426.
[5
] [6 <./images//classic_bpf.jpg>]
<images//cbpf_prog.jpg, id=446, 403.5075pt x 451.6875pt>
<images//cbpf_prog.jpg, id=509, 403.5075pt x 451.6875pt>
File: images//cbpf_prog.jpg Graphic file (type jpg)
<use images//cbpf_prog.jpg>
Package pdftex.def Info: images//cbpf_prog.jpg used on input line 453.
(pdftex.def) Requested size: 227.62204pt x 254.80415pt.
[7 <./images/cBPF_prog.jpg>]
<images//bpf_instructions.png, id=456, 380.92313pt x 475.27562pt>
<images//bpf_instructions.png, id=519, 380.92313pt x 475.27562pt>
File: images//bpf_instructions.png Graphic file (type png)
<use images//bpf_instructions.png>
Package pdftex.def Info: images//bpf_instructions.png used on input line 493.
(pdftex.def) Requested size: 227.62204pt x 283.99998pt.
[8 <./images//bpf_instructions.png>]
<images//bpf_address_mode.png, id=466, 417.05812pt x 313.67188pt>
<images//bpf_address_mode.png, id=529, 417.05812pt x 313.67188pt>
File: images//bpf_address_mode.png Graphic file (type png)
<use images//bpf_address_mode.png>
Package pdftex.def Info: images//bpf_address_mode.png used on input line 509.
(pdftex.def) Requested size: 227.62204pt x 171.19905pt.
[9 <./images//bpf_address_mode.png>]
<images//tcpdump_example.png, id=478, 534.99875pt x 454.69875pt>
<images//tcpdump_example.png, id=542, 534.99875pt x 454.69875pt>
File: images//tcpdump_example.png Graphic file (type png)
<use images//tcpdump_example.png>
Package pdftex.def Info: images//tcpdump_example.png used on input line 524.
(pdftex.def) Requested size: 284.52756pt x 241.82869pt.
<images//cBPF_prog_ex_sol.png, id=481, 242.9075pt x 321.2pt>
<images//cBPF_prog_ex_sol.png, id=545, 242.9075pt x 321.2pt>
File: images//cBPF_prog_ex_sol.png Graphic file (type png)
<use images//cBPF_prog_ex_sol.png>
Package pdftex.def Info: images//cBPF_prog_ex_sol.png used on input line 535.
(pdftex.def) Requested size: 170.71652pt x 225.74026pt.
[10 <./images//tcpdump_example.png>] [11 <./images//cBPF_prog_ex_sol.png>]
<images//ebpf_arch.jpg, id=500, 739.76375pt x 472.76625pt>
<images//ebpf_arch.jpg, id=563, 739.76375pt x 472.76625pt>
File: images//ebpf_arch.jpg Graphic file (type jpg)
<use images//ebpf_arch.jpg>
Package pdftex.def Info: images//ebpf_arch.jpg used on input line 574.
@@ -1274,16 +1268,16 @@ Overfull \hbox (17.02478pt too wide) in paragraph at lines 627--628
[]
[14]
Overfull \hbox (30.83617pt too wide) in paragraph at lines 677--686
Overfull \hbox (56.55217pt too wide) in paragraph at lines 677--688
[][]
[]
LaTeX Warning: Reference `table:ebpf_maps' on page 15 undefined on input line 6
90.
92.
Overfull \hbox (11.26865pt too wide) in paragraph at lines 690--691
Overfull \hbox (11.26865pt too wide) in paragraph at lines 692--693
\T1/txr/m/n/12 de-vel-op-ment of our rootkit, we will mainly fo-cus on hash map
s (BPF_MAP_TYPE_HASH),
[]
@@ -1291,162 +1285,204 @@ s (BPF_MAP_TYPE_HASH),
[15]
LaTeX Warning: Reference `table:bpf_syscall' on page 16 undefined on input line
700.
702.
Overfull \hbox (42.01218pt too wide) in paragraph at lines 703--719
Overfull \hbox (42.01218pt too wide) in paragraph at lines 705--721
[][]
[]
[16]
LaTeX Warning: Reference `section:TODO' on page 17 undefined on input line 746.
LaTeX Warning: Reference `section:TODO' on page 17 undefined on input line 748.
Overfull \hbox (13.5802pt too wide) in paragraph at lines 756--784
Overfull \hbox (13.5802pt too wide) in paragraph at lines 758--788
[][]
[]
[17]
<images//xdp_diag.jpg, id=580, 649.42625pt x 472.76625pt>
<images//xdp_diag.jpg, id=643, 649.42625pt x 472.76625pt>
File: images//xdp_diag.jpg Graphic file (type jpg)
<use images//xdp_diag.jpg>
Package pdftex.def Info: images//xdp_diag.jpg used on input line 800.
Package pdftex.def Info: images//xdp_diag.jpg used on input line 804.
(pdftex.def) Requested size: 426.79134pt x 310.69934pt.
[18] [19 <./images//xdp_diag.jpg>]
Overfull \hbox (5.80417pt too wide) in paragraph at lines 863--875
Overfull \hbox (5.80417pt too wide) in paragraph at lines 867--879
[][]
[]
[20] [21] [22] [23]
<images//libbpf_prog.jpg, id=639, 543.02875pt x 502.87875pt>
<images//libbpf_prog.jpg, id=702, 543.02875pt x 502.87875pt>
File: images//libbpf_prog.jpg Graphic file (type jpg)
<use images//libbpf_prog.jpg>
Package pdftex.def Info: images//libbpf_prog.jpg used on input line 966.
Package pdftex.def Info: images//libbpf_prog.jpg used on input line 977.
(pdftex.def) Requested size: 341.43306pt x 316.20142pt.
[24]
LaTeX Warning: Reference `TODO' on page 25 undefined on input line 994.
LaTeX Warning: Reference `TODO' on page 25 undefined on input line 1005.
[25 <./images//libbpf_prog.jpg>] [26]
Chapter 3.
Overfull \hbox (15.27466pt too wide) in paragraph at lines 1029--1057
[][]
[]
[27
]
Overfull \hbox (144.2746pt too wide) in paragraph at lines 1069--1070
[]\T1/txr/bx/n/12 Unprivileged users \T1/txr/m/n/12 can only load and at-tach e
BPF pro-grams of type BPF_PROG_TYPE_SOCKET_FILTER[[][]53[][]],
[]
[28]
Overfull \hbox (33.33205pt too wide) in paragraph at lines 1095--1096
[]\T1/txr/m/n/12 Therefore, eBPF net-work pro-grams usu-ally re-quire both CAP_
BPF and CAP_NET_ADMIN,
[]
[29]
Overfull \hbox (18.75664pt too wide) in paragraph at lines 1125--1126
\T1/txr/m/n/12 can also ex-plore all the avail-able maps in the sys-tem by us-i
ng the BPF_MAP_GET_NEXT_ID
[]
(/usr/share/texlive/texmf-dist/tex/latex/listings/lstlang1.sty
File: lstlang1.sty 2020/03/24 1.8d listings language file
)
(/usr/share/texlive/texmf-dist/tex/latex/listings/lstmisc.sty
File: lstmisc.sty 2020/03/24 1.8d (Carsten Heinz)
)
Package hyperref Info: bookmark level for unknown lstlisting defaults to 0 on i
nput line 1141.
LaTeX Font Info: Trying to load font information for T1+txtt on input line 1
141.
(/usr/share/texlive/texmf-dist/tex/latex/txfonts/t1txtt.fd
File: t1txtt.fd 2000/12/15 v3.1
) [30]
LaTeX Font Info: Font shape `T1/txtt/b/n' in size <10> not available
(Font) Font shape `T1/txtt/bx/n' tried instead on input line 1143.
[31] [32]
Chapter 4.
[28
[33
]
Chapter 5.
[29
[34
]
Chapter 6.
[30
[35
]
LaTeX Font Info: Trying to load font information for T1+txtt on input line 1
031.
(/usr/share/texlive/texmf-dist/tex/latex/txfonts/t1txtt.fd
File: t1txtt.fd 2000/12/15 v3.1
)
Overfull \hbox (5.34976pt too wide) in paragraph at lines 1032--1032
Overfull \hbox (5.34976pt too wide) in paragraph at lines 1291--1291
\T1/txtt/m/n/12 threat -[] intelligence / cyber -[] year -[] in -[] retrospect
/ yir -[] cyber -[] threats -[]
[]
[31
[36
]
Overfull \hbox (6.22696pt too wide) in paragraph at lines 1032--1032
Overfull \hbox (6.22696pt too wide) in paragraph at lines 1291--1291
[]\T1/txr/m/it/12 Bpf fea-tures by linux ker-nel ver-sion\T1/txr/m/n/12 , io-vi
-sor. [On-line]. Avail-able: [][]$\T1/txtt/m/n/12 https : / / github .
[]
Overfull \hbox (7.34976pt too wide) in paragraph at lines 1032--1032
Overfull \hbox (7.34976pt too wide) in paragraph at lines 1291--1291
[][]$\T1/txtt/m/n/12 https : / / ebpf . io / what -[] is -[] ebpf / #loader -[]
-[] verification -[] architecture$[][]\T1/txr/m/n/12 .
[]
Overfull \hbox (21.24973pt too wide) in paragraph at lines 1032--1032
Overfull \hbox (21.24973pt too wide) in paragraph at lines 1291--1291
\T1/txtt/m/n/12 vger . kernel . org / netconf2015Starovoitov -[] bpf _ collabsu
mmit _ 2015feb20 .
[]
[32]
Overfull \hbox (9.14975pt too wide) in paragraph at lines 1032--1032
[37]
Overfull \hbox (9.14975pt too wide) in paragraph at lines 1291--1291
\T1/txtt/m/n/12 ch02 . xhtml# :-[]: text = With % 20JIT % 20compiled % 20code %
2C % 20i ,[] %20other %
[]
Overfull \hbox (6.49615pt too wide) in paragraph at lines 1032--1032
Overfull \hbox (6.49615pt too wide) in paragraph at lines 1291--1291
[]\T1/txr/m/n/12 D. Lavie. ^^P A gen-tle in-tro-duc-tion to xdp.^^Q (Feb. 3, 2
022), [On-line]. Avail-able: [][]$\T1/txtt/m/n/12 https :
[]
[33]
Overfull \hbox (0.76683pt too wide) in paragraph at lines 1032--1032
[38]
Overfull \hbox (0.76683pt too wide) in paragraph at lines 1291--1291
[]\T1/txr/m/n/12 ^^P Bpf next ker-nel tree.^^Q (), [On-line]. Avail-able: [][]
$\T1/txtt/m/n/12 https : / / kernel . googlesource .
[]
[34] [1
]
Overfull \hbox (14.49278pt too wide) in paragraph at lines 1291--1291
[]\T1/txr/m/it/12 Capabilities - overview of linux ca-pa-bil-i-ties\T1/txr/m/n/
12 . [On-line]. Avail-able: [][]$\T1/txtt/m/n/12 http : / / manpages .
[]
Package caption Warning: Unused \captionsetup[lstlisting] on input line 164.
See the caption package documentation for explanation.
[39]
Overfull \hbox (53.32059pt too wide) in paragraph at lines 1291--1291
\T1/txr/m/it/12 sup-ple-ment\T1/txr/m/n/12 , Jan. 28, 2018, p. 148. [On-line].
Avail-able: [][]$\T1/txtt/m/n/12 https : / / raw . githubusercontent .
[]
pdfTeX warning (ext4): destination with the same identifier (name{page.}) has b
een already used, duplicate ignored
[40] (/usr/share/texlive/texmf-dist/tex/latex/listings/lstlang1.sty
File: lstlang1.sty 2020/03/24 1.8d listings language file
)
(/usr/share/texlive/texmf-dist/tex/latex/listings/lstlang1.sty
File: lstlang1.sty 2020/03/24 1.8d listings language file
) [1
]pdfTeX warning (ext4): destination with the same identifier (name{page.}) has
been already used, duplicate ignored
<to be read again>
\relax
l.1048 \end{document}
l.1351 \end{document}
[2
] (./document.aux)
LaTeX Warning: There were undefined references.
Package rerunfilecheck Warning: File `document.out' has changed.
(rerunfilecheck) Rerun to get outlines right
(rerunfilecheck) or use package `bookmark'.
Package rerunfilecheck Info: Checksums for `document.out':
(rerunfilecheck) Before: DDEC2EA0BA9DDEC568FE05D8A7BB7EC7;2555
(rerunfilecheck) After: 82639416354DA222C60093A493D29911;2634.
Package rerunfilecheck Info: File `document.out' has not changed.
(rerunfilecheck) Checksum: 986F56F3947BD730EBF6BFF75F31FFDD;3180.
Package logreq Info: Writing requests to 'document.run.xml'.
\openout1 = `document.run.xml'.
)
Here is how much of TeX's memory you used:
27509 strings out of 481209
439698 string characters out of 5914747
1181434 words of memory out of 5000000
43856 multiletter control sequences out of 15000+600000
453959 words of font info for 100 fonts, out of 8000000 for 9000
28129 strings out of 481209
447183 string characters out of 5914747
1335757 words of memory out of 5000000
44399 multiletter control sequences out of 15000+600000
459242 words of font info for 106 fonts, out of 8000000 for 9000
36 hyphenation exceptions out of 8191
88i,12n,90p,1029b,3681s stack positions out of 5000i,500n,10000p,200000b,80000s
88i,12n,90p,1029b,3702s stack positions out of 5000i,500n,10000p,200000b,80000s
{/usr/share/texlive/texmf-dist/fonts/enc/dvips/base/8r.enc}</usr/share/texliv
e/texmf-dist/fonts/type1/public/txfonts/rtcxi.pfb></usr/share/texlive/texmf-dis
t/fonts/type1/public/txfonts/rtcxr.pfb></usr/share/texlive/texmf-dist/fonts/typ
e1/public/txfonts/rtxb.pfb></usr/share/texlive/texmf-dist/fonts/type1/public/tx
fonts/rtxi.pfb></usr/share/texlive/texmf-dist/fonts/type1/public/txfonts/rtxr.p
fb></usr/share/texlive/texmf-dist/fonts/type1/public/txfonts/t1xtt.pfb></usr/sh
are/texlive/texmf-dist/fonts/type1/urw/helvetic/uhvb8a.pfb></usr/share/texlive/
texmf-dist/fonts/type1/urw/helvetic/uhvr8a.pfb></usr/share/texlive/texmf-dist/f
onts/type1/urw/helvetic/uhvr8a.pfb></usr/share/texlive/texmf-dist/fonts/type1/u
rw/times/utmb8a.pfb></usr/share/texlive/texmf-dist/fonts/type1/urw/times/utmr8a
.pfb></usr/share/texlive/texmf-dist/fonts/type1/urw/times/utmri8a.pfb>
Output written on document.pdf (51 pages, 726289 bytes).
fb></usr/share/texlive/texmf-dist/fonts/type1/public/txfonts/t1xbtt.pfb></usr/s
hare/texlive/texmf-dist/fonts/type1/public/txfonts/t1xtt.pfb></usr/share/texliv
e/texmf-dist/fonts/type1/urw/helvetic/uhvb8a.pfb></usr/share/texlive/texmf-dist
/fonts/type1/urw/helvetic/uhvr8a.pfb></usr/share/texlive/texmf-dist/fonts/type1
/urw/helvetic/uhvr8a.pfb></usr/share/texlive/texmf-dist/fonts/type1/urw/times/u
tmb8a.pfb></usr/share/texlive/texmf-dist/fonts/type1/urw/times/utmr8a.pfb></usr
/share/texlive/texmf-dist/fonts/type1/urw/times/utmri8a.pfb>
Output written on document.pdf (58 pages, 775719 bytes).
PDF statistics:
898 PDF objects out of 1000 (max. 8388607)
168 named destinations out of 1000 (max. 500000)
356 words of extra memory for PDF output out of 10000 (max. 10000000)
1098 PDF objects out of 1200 (max. 8388607)
232 named destinations out of 1000 (max. 500000)
420 words of extra memory for PDF output out of 10000 (max. 10000000)