Tools Used to Recover from Kernel-Level Rootkits

ToolVersionDescription
read-sctp.c0.1Reads the system call table pointer as referenced in the system call handler.
read-scte.c0.1Reads a given entry in the system call table.
read-sys_call.c0.1Dumps a given system call from kernel memory to a file.
ktext.c0.1Reads ktext kernel memory and dumps it to a file.
write-sctp.c0.1Writes the given system call table pointer to the system call handler.
write-scte.c0.1Writes the given system call table entry to the system call table.
write-sys_call.c0.1Writes the given system call (from a file) to kernel memory.
recover-kkit.c0.1Recovers from a kernel-level rootkit. Installs trusted system call table.
sct_tools.tar.gz0.1Tarball of above tools.
COPYRIGHTDistributed under the General Public License (GPL)

Developers: Julian Grizzard and John Levine



Contact: Julian Grizzard (grizzard AT ece.gatech.edu) - Replace " AT " with "@"