admin/TripleCross
1
0
Fork 0
mirror of https://github.com/h3xduck/TripleCross.git synced 2025-12-29 12:43:08 +08:00
Code Issues Packages Projects Releases Wiki Activity

New explanation for the injection technique (alternative scanning process) and added flow diagram with full process.

Browse Source
This commit is contained in:
h3xduck
2022-06-13 10:57:32 -04:00
parent 050684c4d7
commit 99ad9c5548
15 changed files with 30 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
docs/chapters/annex.tex
View File

@@ -2,12 +2,10 @@
% ANEX
%----------
%M-> Mentioned putting some demos and PoCs here...
%
%Including bpftool commands here to be referenced. Is it a good idea?
\chapter* {Appendix A - Bpftool commands} \label{annex:bpftool_flags_kernel}
\pagenumbering{gobble} % Las páginas de los anexos no se numeran
\section*{eBPF-related kernel compilation flags}
@@ -195,6 +193,15 @@ pop rbp # 5D
jmp qword ptr [rip+0x0] # FF2500000000
<address original syscall glibc 64bit>
\end{lstlisting}
\end{lstlisting}
\chapter* {Appendix D - Rootkit flow diagrams} \label{annex:flow_diagrams}
\pagenumbering{gobble} % Las páginas de los anexos no se numeran
\section*{Library injection via GOT hijacking} \label{annexsec:lib_injection}
\begin{figure}[htbp]
\centering
\includegraphics[width=15cm]{flow_lib_injection_compact.png}
\caption{Flow diagram of execution of a successful library injection.}
\label{fig:flow_lib_injection_compact}
\end{figure}