Skip to content

Commit 8b49f8b

Browse files
Ceald1Ceald1
committed
kernel hacking draft
1 parent 2d5ee94 commit 8b49f8b

5 files changed

Lines changed: 104 additions & 46 deletions

File tree

‎content/posts/kernel_hacking.md‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
+++
2+
title = "Kernel_hacking"
3+
date = "2026-02-17T00:05:22-07:00"
4+
#dateFormat = "2006-01-02" # This value can be configured for per-post date formatting
5+
author = "Ceald"
6+
# authorTwitter = "" # do not include @
7+
cover = "https://media1.tenor.com/m/oZJ_94Ngnl8AAAAd/penguin-linux.gif"
8+
tags = ["linux", "ebpf", "lkms", "malware", "C", "programming"]
9+
keywords = ["linux", "kernel", "hacking", "C"]
10+
description = "A dive into linux kernel hacking"
11+
showFullContent = false
12+
readingTime = true
13+
hideComments = false
14+
+++
15+
16+
17+
# Generic Title
18+
19+
Let's skip introductions, everyone knows what Linux is and that it's a kernel and not an OS. Most people tend to overlook how the kernel actually works not just how to install or compile packages. This article will go over how the kernel actually functions and not a "zero to hero" post.
20+
21+
# Building Wootkits
22+
23+
It's the big 26 as of writing this and writing a hooked library seems a bit outdated and generic so why not live a bit on the edge and do something directly at the kernel level?
24+
25+
## Limitations
26+
27+
Unless you're like 80 years old or something you can't modify the system call table directly anymore for safety but that's okay it's still very nice to make scary kernel modules or eBPFs.
28+
29+
## Hooks
30+
31+
In Linux you can hook system calls meaning you can intercept and modify them. If you want to see how this is done it's super easy to do using kprobes. You make a generic Linux kernel module and then create a variable with the structure type `kprobe`, the variables in the structure tell kprobes where the hook sits in the execution flow, the symbol like `"__x64_sys_kill"`. Having something like `pre_handler` set to a function means that your function will sit right after the system call is made before anything else runs. You can register probes with the `register_kprobe(&my_kprobe_structure)` function and a pointer to your kprobes structure.
32+
33+
An issue with using kprobes is you can't really interrupt the execution flow that much but mostly debug. Using ftrace accomplishes full system call hooking. Think of kprobes as read only mostly while ftrace is full read and write.
34+
35+
Ftrace allows you to fully control the system call hook as much as possible but the issue is you're manipulating the system call or overwriting the system call and can cause issues if you don't have the proper hook set up.
36+
37+
### eBPFs
38+
39+
A "safe" way of hooking into system calls is by using an eBPF but you're only given read only access to kernel memory and can't change any of it. Now this isn't super bad and totally workable but it'd only be good if you just want to do something like capture PAM credentials or lock down an entire system by denying everything access to every file. These are much harder to screw up but their ecosystem isn't as mature and more DIY than kernel modules. eBPFs are great but not there yet and still very neat for a niche skill for kernel programming.
40+
41+
BPFs are used for things like policy enforcement with projects like Kube Armor by hooking Linux Security Modules or LSMs. If a rootkit is an eBPF there almost certainly needs to be another program in the background that's sending out the data it collects because eBPFs are reactionary because they use system call hooks. BPFs have even more restrictions than just having read only access to kernel land by having memory limitations in place because they're ran in a VM inside of the kernel.

‎public/index.html‎

Lines changed: 45 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -183,6 +183,51 @@
183183

184184

185185

186+
<article class="post on-list">
187+
<h2 class="post-title">
188+
<a href="//localhost:1313/posts/kernel_hacking/">Kernel_hacking</a>
189+
</h2>
190+
191+
<div class="post-meta"><time class="post-date">2026-02-17</time><span class="post-author">Ceald</span></div>
192+
193+
194+
<span class="post-tags">
195+
196+
#<a href="//localhost:1313/tags/linux/">linux</a>&nbsp;
197+
198+
#<a href="//localhost:1313/tags/ebpf/">ebpf</a>&nbsp;
199+
200+
#<a href="//localhost:1313/tags/lkms/">lkms</a>&nbsp;
201+
202+
#<a href="//localhost:1313/tags/malware/">malware</a>&nbsp;
203+
204+
#<a href="//localhost:1313/tags/c/">C</a>&nbsp;
205+
206+
#<a href="//localhost:1313/tags/programming/">programming</a>&nbsp;
207+
208+
</span>
209+
210+
211+
212+
<img src="https://media1.tenor.com/m/oZJ_94Ngnl8AAAAd/penguin-linux.gif"
213+
class="post-cover"
214+
alt="Kernel_hacking"
215+
title="Cover Image" />
216+
217+
218+
<div class="post-content">
219+
220+
<p>A dive into linux kernel hacking</p>
221+
222+
</div>
223+
224+
225+
<div>
226+
<a class="read-more button inline" href="/posts/kernel_hacking/">[Read more]</a>
227+
</div>
228+
229+
</article>
230+
186231
<article class="post on-list">
187232
<h2 class="post-title">
188233
<a href="//localhost:1313/posts/bpfs/">Bpfs</a>
@@ -349,44 +394,6 @@ <h2 id="stealing-tokens-via-windows-processes">Stealing Tokens Via Windows Proce
349394

350395
</article>
351396

352-
<article class="post on-list">
353-
<h2 class="post-title">
354-
<a href="//localhost:1313/posts/winregistrysecrets/">Win-Registry-Secrets</a>
355-
</h2>
356-
357-
<div class="post-meta"><time class="post-date">2025-03-20</time><span class="post-author">Ceald</span></div>
358-
359-
360-
<span class="post-tags">
361-
362-
#<a href="//localhost:1313/tags/windows/">windows</a>&nbsp;
363-
364-
#<a href="//localhost:1313/tags/new/">new</a>&nbsp;
365-
366-
#<a href="//localhost:1313/tags/go/">go</a>&nbsp;
367-
368-
</span>
369-
370-
371-
372-
373-
374-
<div class="post-content">
375-
376-
<h2 id="intro">Intro</h2>
377-
<p>The windows registry is a system database that contains keys and values. Some things in the registry include; Windows credentials, cached passwords, usernames, and other credentials. In windows a group of keys is called a &ldquo;hive&rdquo; the hives that are the cool ones are; SAM, System, and Security.</p>
378-
<h2 id="system-hive">SYSTEM Hive</h2>
379-
<p>The most important registry hive is the &ldquo;System&rdquo; hive, in the key: <code>CurrentControlSet\Control\Lsa</code> there are the necessary components to craft the boot key which will be used to decrypt the rest of the registry database to get things like hashes for users. Here&rsquo;s some example code from &ldquo;Go-Go-Gadget-Katz&rdquo; for getting the boot key:</p>
380-
381-
</div>
382-
383-
384-
<div>
385-
<a class="read-more button inline" href="/posts/winregistrysecrets/">[Read more]</a>
386-
</div>
387-
388-
</article>
389-
390397

391398
<div class="pagination">
392399
<div class="pagination__buttons">

‎public/index.xml‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,15 @@
66
<description>Recent content on Ceald&#39;s blog</description>
77
<generator>Hugo</generator>
88
<language>en-us</language>
9-
<lastBuildDate>Mon, 02 Feb 2026 00:25:35 -0700</lastBuildDate>
9+
<lastBuildDate>Tue, 17 Feb 2026 00:05:22 -0700</lastBuildDate>
1010
<atom:link href="//localhost:1313/index.xml" rel="self" type="application/rss+xml" />
11+
<item>
12+
<title>Kernel_hacking</title>
13+
<link>//localhost:1313/posts/kernel_hacking/</link>
14+
<pubDate>Tue, 17 Feb 2026 00:05:22 -0700</pubDate>
15+
<guid>//localhost:1313/posts/kernel_hacking/</guid>
16+
<description>&lt;h1 id=&#34;generic-title&#34;&gt;Generic Title&lt;/h1&gt;&#xA;&lt;p&gt;Let&amp;rsquo;s skip introductions, everyone knows what Linux is and that it&amp;rsquo;s a kernel and not an OS. Most people tend to overlook how the kernel actually works not just how to install or compile packages. This article will go over how the kernel actually functions and not a &amp;ldquo;zero to hero&amp;rdquo; post.&lt;/p&gt;&#xA;&lt;h1 id=&#34;building-wootkits&#34;&gt;Building Wootkits&lt;/h1&gt;&#xA;&lt;p&gt;It&amp;rsquo;s the big 26 as of writing this and writing a hooked library seems a bit outdated and generic so why not live a bit on the edge and do something directly at the kernel level?&lt;/p&gt;</description>
17+
</item>
1118
<item>
1219
<title>Bpfs</title>
1320
<link>//localhost:1313/posts/bpfs/</link>

‎public/sitemap.xml‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,23 +2,26 @@
22
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9"
33
xmlns:xhtml="http://www.w3.org/1999/xhtml">
44
<url>
5+
<loc>//localhost:1313/</loc>
6+
<lastmod>2026-02-17T00:05:22-07:00</lastmod>
7+
</url><url>
8+
<loc>//localhost:1313/posts/kernel_hacking/</loc>
9+
<lastmod>2026-02-17T00:05:22-07:00</lastmod>
10+
</url><url>
11+
<loc>//localhost:1313/posts/</loc>
12+
<lastmod>2026-02-17T00:05:22-07:00</lastmod>
13+
</url><url>
514
<loc>//localhost:1313/posts/bpfs/</loc>
615
<lastmod>2026-02-02T00:25:35-07:00</lastmod>
716
</url><url>
817
<loc>//localhost:1313/tags/c/</loc>
918
<lastmod>2026-02-02T00:25:35-07:00</lastmod>
10-
</url><url>
11-
<loc>//localhost:1313/</loc>
12-
<lastmod>2026-02-02T00:25:35-07:00</lastmod>
1319
</url><url>
1420
<loc>//localhost:1313/tags/ebpf/</loc>
1521
<lastmod>2026-02-02T00:25:35-07:00</lastmod>
1622
</url><url>
1723
<loc>//localhost:1313/tags/malware/</loc>
1824
<lastmod>2026-02-02T00:25:35-07:00</lastmod>
19-
</url><url>
20-
<loc>//localhost:1313/posts/</loc>
21-
<lastmod>2026-02-02T00:25:35-07:00</lastmod>
2225
</url><url>
2326
<loc>//localhost:1313/tags/</loc>
2427
<lastmod>2026-02-02T00:25:35-07:00</lastmod>

‎public/tags/index.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -252,7 +252,7 @@ <h1>Tags</h1>
252252

253253

254254
<li>
255-
<a class="terms-title" href="//localhost:1313/tags/new/">new [6]</a>
255+
<a class="terms-title" href="//localhost:1313/tags/new/">New [6]</a>
256256
</li>
257257

258258

0 commit comments

Comments
 (0)