23.12.2014 Views

Defiling Mac OS X - Ruxcon - Reverse Engineering Mac OS X - PUT ...

Defiling Mac OS X - Ruxcon - Reverse Engineering Mac OS X - PUT ...

Defiling Mac OS X - Ruxcon - Reverse Engineering Mac OS X - PUT ...

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

TECHNIQUES<br />

SYSCALL HOOKS<br />

Old faithful<br />

‣ First port of call for rootkittery<br />

‣ Replace a syscall with our own function<br />

‣ Do something bad<br />

‣ Call the syscall like normal<br />

‣ Maybe do something bad to the return value<br />

‣ <strong>OS</strong> X has two kinds<br />

‣ <strong>Mac</strong>h syscalls<br />

‣ BSD syscalls<br />

<strong>Defiling</strong> <strong>Mac</strong> <strong>OS</strong> X - <strong>Ruxcon</strong><br />

November, 2011

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!