Re: why is the sys_close symbol exported ?

On Fri, 18 Nov 2016 09:56:52 +0100 jmfriedt wrote: > Following the various rootkit and system call redirection developments, the > current > way of identifying the location of the system call table seems to be brute > force scanning > the memory for the location of one of the system calls. Thi

why is the sys_close symbol exported ?

Following the various rootkit and system call redirection developments, the current way of identifying the location of the system call table seems to be brute force scanning the memory for the location of one of the system calls. This is only possible from a module if the symbol is exported: I