Skip to main content

check_syscall_table

Function check_syscall_table 

Source
pub fn check_syscall_table<P: PhysicalMemoryProvider>(
    reader: &ObjectReader<P>,
) -> Result<Vec<SyscallInfo>>
Expand description

Check the syscall table for hooks.

Reads sys_call_table entries and compares each handler against the _stext.._etext kernel text range. Returns info for each entry, marking entries outside the text region as potentially hooked.