The tools contained here are for re-establishing trust in a compromised host
that has been infected with a kernel-level rootkit that modifies the system
call table.  These tools are based on code from the sucKIT rootkit.

For the most up to date tools and other related research, see our webpage:
http://www.ece.gatech.edu/research/labs/nsa/index.shtml

USE at your own risk.  We are not responsible for any damage caused to your 
system.  This code base is considered research quality, so you should not 
rely on it for production use.

CAREFUL!  IT IS POSSIBLE TO COMPLETELY DESTORY YOUR SYSTEM AND VERY EASY TO 
CRASH YOUR SYSTEM IF YOU DO NOT KNOW WHAT YOU ARE DOING!

Running the tools requires root access.  Here is a short description of the
provided tools:

ktext <outfile> <hex_startaddr> <hex_endaddr>
   reads from 'hex_startaddr' to 'hex_endaddr' in kernel
   memory and outputs contents to 'outfile'
read-scte <sys_call_num>
   prints sytem call table entry 'sys_call_num' to stdout
read-sctp 
   prints address of system call table to stdout
read-sys_call <sys_call_num> <outfile>
   dumps contents of system call 'sys_call_num' to 'outfile'
write-scte <sys_call_num> <hex_addr>
   writes 'hex_addr' into the 'sys_call_num' sct entry
write-sctp <hex_addr>
   redirects system call table to 'hex_addr'
write-sys_call <sys_call_num> <infile>
   writes contents of 'infile' to kmem and points 'sys_call_num' sct
   entry to that memory location

Please send all comments or questions to 

Julian Grizzard 
grizzard AT ece.gatech.edu

John Levine also contributed to the code
