Re: Kernel Text Comparison

["Mulyadi Santosa" <mulyadi.santosa@xxxxxxxxx>]

Hi...


> Hi everyone,
> I am working on a program that checks the integrity of the kernel code
> to detect the presence of kernel rootkits. As a first step I am trying
> to compare the text section of vmlinux with the text area dumped from
> memory. I understand that vmlinux has no relocation entries and no
> unresolved symbols, so the memory image and vmlinux should compare equal.
>
> I used hexdump on vmlinux and /dev/mem to compare the two, I find that
just fyi, IIRC most distro now just use /dev/kmem

> for most part of it they compare equal, but they differ in some bytes
> scattered all over the text. Is my understanding flawed? It would be
> great if somebody could explain why the memory image is different from
> vmlinux.

maybe you hit piece of code that were:
- referred/wrapped by alternatives() (I may not recall correctly), so
the code is patched on the fly
- code that is marked with __init and similar, so they are dumped out
of memory when not needed anymore. Example: boot only codes

Maybe the rest of kernelnewbies folks can provide better explanation.

regards,

Mulyadi

--
To unsubscribe from this list: send an email with
"unsubscribe kernelnewbies" to ecartis@xxxxxxxxxxxx
Please read the FAQ at http://kernelnewbies.org/FAQ