Linux Edu Handbook - krd

general

anonymous@undisclosed.example.com (Anonymous) — Thu, 15 Apr 2010 19:18:57 +0000

krd prototype structure version 0.1 pre Modules found in krd: * kcore reader, 1 function: - kcore reader reads the complete /proc/kcore file and returns data sequences to the signature engine. * signature engine, 2 functions: - creates the signatures database via a text file named signatures.txt (located in /usr/local/etc/krd)

reader

anonymous@undisclosed.example.com (Anonymous) — Thu, 15 Apr 2010 19:18:57 +0000

krd reader krd reader matches signatures with data read from /proc/kcore - krd creates a buffer of n bytes, which it fills with bytes from kcore. When the buffer is full, it will simply rotate off 8 bits from the left, which removes the oldest byte. It then adds the newest byte in from the reader engine.

siggen

anonymous@undisclosed.example.com (Anonymous) — Thu, 15 Apr 2010 19:18:57 +0000

krd can perform a hex dump of common linux binaries: bozo@lust:~/krd-pre0.2/src$ ./krd -h /bin/ls|less ./krd pre0.1 [ Guillaume R. ./krd [-c hex] [-h file] 7F454C460101010000000000000000000200030001000000F0960408340000009017010000000000 34002000080028001A00190006000000340000003480040834800408000100000001000005000000 04000000030000003401000034810408348104081300000013000000040000000100000001000000

signatures

anonymous@undisclosed.example.com (Anonymous) — Thu, 15 Apr 2010 19:18:57 +0000

Signatures file 0.1 pre * Information on signature generation: siggen Here is a snippet of the current signatures file: The structure is pretty simple. There are two lines for each signature.. *The first line is the hex signature of what we are looking for: strings, data, etc.