Defiling Mac OS X - Ruxcon - Reverse Engineering Mac OS X - PUT ...
Defiling Mac OS X - Ruxcon - Reverse Engineering Mac OS X - PUT ...
Defiling Mac OS X - Ruxcon - Reverse Engineering Mac OS X - PUT ...
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
TECHNIQUES<br />
SYSCALL HOOKS<br />
Old faithful<br />
‣ First port of call for rootkittery<br />
‣ Replace a syscall with our own function<br />
‣ Do something bad<br />
‣ Call the syscall like normal<br />
‣ Maybe do something bad to the return value<br />
‣ <strong>OS</strong> X has two kinds<br />
‣ <strong>Mac</strong>h syscalls<br />
‣ BSD syscalls<br />
<strong>Defiling</strong> <strong>Mac</strong> <strong>OS</strong> X - <strong>Ruxcon</strong><br />
November, 2011
Change language