Module check_fops 

Linux file_operations table hook detector.

Rootkits often replace function pointers in file_operations structs (read, write, open, etc.) for /proc entries or device files. By comparing these pointers against the kernel text range (_stext.._etext), we can detect hooks pointing to non-kernel code (loaded module code or injected memory).

Structs

FopsHookInfo

Information about a file_operations struct with potential hooks.

HookedFop

A single function pointer from a file_operations struct.

Functions

check_fops_entry

Read function pointers from a file_operations struct and classify each.

is_kernel_text_address

Check whether an address falls within the kernel text section.

scan_proc_fops

Scan key /proc entries for file_operations hooks.