摘要
分析了LKM后门实现隐藏进程的机理。针对后门设计存在的缺陷,结合/proc文件系统特点,提出了一种按顺序遍历所有PID目录而找出全部进程的方法。再将结果与普通的进程查找输出作对比,可以发现隐藏的进程。最后给出采用Perl语言实现此查找功能的流程图。实验表明该方法能准确、有效地发现被LKM后门隐藏的进程。
This paper analyses the mechanism of LKM backdoor in hiding processes.According to the vulnerability in design and the characteristics of /proc file system,a new method for finding hidden processes is proposed,that is,traversing all possible existing PID directories to find out all actually existing processes,then through contrasting with the ordinary output to discover the differences.At last the workilow in Perl has been provided.The experiments show that this method presented can efficiently find the processes hidden by LKM backdoor.
出处
《计算机工程与应用》
CSCD
北大核心
2007年第3期102-105,共4页
Computer Engineering and Applications
基金
航空科学基金资助项目(01F53031)
教育部博士点基金资助项目(20020699026)。
