curuncula dbr rootkit detection tool
- From: Giuseppe Cocomazzi <sbudella@xxxxxxxx>
- Date: Fri, 24 Apr 2009 00:13:59 +0200
I've released a little program named Curuncula.
Curuncula is a tool shipped as a loadable kernel module that aims to
detect rootkits based on the Intel debugging support facilities.
Rootkits that set the GD access flag are also detected. It makes use of
the "last branch recording" mechanism provided by the Intel
architecture. Support both the 2.4 and 2.6 Linux kernels.
Complete source code can be found here:
I hope you find it useful.
every day above ground is a good one.
- Prev by Date: RE: [tool] Unix auditing, Lynis 1.2.5
- Previous by thread: RE: [tool] Unix auditing, Lynis 1.2.5