NoviceLive/research-rootkit

sys_close is not exported any more since kernel 4.17.0

NoviceLive opened this issue · 1 comments

Now sys_close is referenced only when LINUX_VERSION_CODE < KERNEL_VERSION(4, 17, 0).
Tries via kallsyms_lookup_name or register_kprobe were added.