Hi,
at first s00ry for this banner.(I am interested in how many people send me to hell )
So lets go: -> I am looking for people who wants to develope with me a modern type of rootkit (oh no shits such ADORE/KNARK).
I have got prototype now.
Some description:
- no LKM support needed (/dev/kmem)
- no compilation on victim
- all kernels support
- !!! no change syscall table -> means this:
example mkdir():
user -> kernel -> syscall -> "hacked"mkdir() -> jmp fake_mkdir() -> repair original mkdir() -> mkdir () -> "hack again" mkdir() -> kernel -> user
(idea form Silvio Cesare, i have never seen this metod in published rootkit)

Thx.Blackhunter
(ps:again sorry)