amanone/amark — pull request #1 by amanone (2014-05-12 13:12:13+00:00)
Title: Reverse vmlinux find syscall wip

merge detector sys_open hijacking PoC.
- we didn't use Lime
- we have to work around with something like a STUB http://pastebin.com/raw.php?i=itXHfUzn
- I guess that the code of system calls maybe located to different places depending on some non-deterministic choices and once the memory address is known, the stub is replaced.

- still wip, but the idea is here