Class 09 · KP 14 / 25

Linux: Hooking System Calls

IAT hook: overwrite the import pointer so calls jump to your handler.

Old way: find sys_call_table, flip the page writable (clear CR0 WP bit), overwrite entries like __NR_getdents64 to hide files/processes.
Modern kernels: sys_call_table is read-only and no longer exported — so rootkits pivot to ftrace hooks or kprobes to intercept functions instead.

/* ftrace-based hook: register a callback that rewrites %rip */
static struct ftrace_ops ops = {
    .func  = my_callback,      /* redirect to our handler */
    .flags = FTRACE_OPS_FL_SAVE_REGS | FTRACE_OPS_FL_IPMODIFY,
};
register_ftrace_function(&ops);   /* no need to write the table */