detector: add lime & volatility

  lime: Linux Memory Extractor
  volatility: An advanced memory forensics framework
detector: WIP: add vmlinu{x,z} & other files to find syscall in vmlinux

  the goal is to detect that the in-memory syscall differ from the one
  in vmlinux binary image.
Update .gitignore, detector/.gitignore

  vim tmp-files, and huges (> 2gb dump memory file)
detector: add kernel configuration file
detector: add sys_open_from_vmlinux, assembly for sys_open in vmlinux

 we will match this, with the in memory one.
detector: WIP: update get_vmlinux_symbol.sh
detector: add scripts to check the virtual memory integrity against vmlinux bin

 It's only works for sys_open, but it's still a WIP PoC.
 We can detect if we hijack the syscall. (i.e. overwrite syscall's
 content)

 this can be bypassable if the rootkit write its new version in the
 vmlinux file.

 We will checksum the vmlinux binary, to fix this.

 The python code is *very* wip.
Merge pull request #1 from amanone/reverse_vmlinux_find_syscall_WIP

Reverse vmlinux find syscall wip