Re: Positive uses for rootkits

[Kev <klmitch () MIT EDU>]

> > There *are* wasy around this, but you gotta be good.  If you play with
> > memory locations directly, there are ways to load a module even on a
> > static monloitic kernel.
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> HOW ?! (with modules disabled)
> seems insane to me, although I'm not a kernel hacker.

Simple.  You use a root-owned process to fiddle with the memory directly,
putting the code you want it running in the right place, then fiddling with
appropriate jump vectors to make it be executed at the right time.
Obviously not something for the faint-of-heart...
--
Kevin L. Mitchell <klmitch () mit edu>