admin/TripleCross
1
0
Fork 0
mirror of https://github.com/h3xduck/TripleCross.git synced 2025-12-24 10:23:08 +08:00
Code Issues Packages Projects Releases Wiki Activity

Updated some style aspects, updated positions of tables and figures, other changes.

Browse Source
This commit is contained in:
h3xduck
2022-06-11 16:32:00 -04:00
parent e5bb65925d
commit e697dc867d
16 changed files with 1135 additions and 1099 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
docs/document.lot
View File

@@ -5,33 +5,33 @@
\defcounter {refsection}{0}\relax
\addvspace {10\p@ }
\defcounter {refsection}{0}\relax
\contentsline {table}{\numberline {2.1}{\ignorespaces Table showing BPF instruction format. It is a fixed-length 64 bit instruction, the number of bits used by each field are indicated.\relax }}{8}{table.caption.9}%
\contentsline {table}{\numberline {2.1}{\ignorespaces BPF instruction format.\relax }}{8}{table.caption.9}%
\defcounter {refsection}{0}\relax
\contentsline {table}{\numberline {2.2}{\ignorespaces Table showing relevant eBPF updates. Note that only those relevant for our research objectives are shown. This is a selection of the official complete table at \cite {ebpf_funcs_by_ver}.\relax }}{12}{table.caption.14}%
\contentsline {table}{\numberline {2.2}{\ignorespaces Relevant eBPF updates. Note that only those relevant for our research objectives are shown. This is a selection of the official complete table at \cite {ebpf_funcs_by_ver}.\relax }}{11}{table.caption.14}%
\defcounter {refsection}{0}\relax
\contentsline {table}{\numberline {2.3}{\ignorespaces Table showing eBPF instruction format. It is a fixed-length 64 bit instruction, the number of bits used by each field are indicated.\relax }}{13}{table.caption.16}%
\contentsline {table}{\numberline {2.3}{\ignorespaces eBPF instruction format.\relax }}{12}{table.caption.16}%
\defcounter {refsection}{0}\relax
\contentsline {table}{\numberline {2.4}{\ignorespaces Table showing eBPF registers and their purpose in the BPF VM.\cite {ebpf_inst_set}\cite {ebpf_starovo_slides}.\relax }}{13}{table.caption.17}%
\contentsline {table}{\numberline {2.4}{\ignorespaces eBPF registers and their purpose in the BPF VM. \cite {ebpf_inst_set} \cite {ebpf_starovo_slides}.\relax }}{13}{table.caption.17}%
\defcounter {refsection}{0}\relax
\contentsline {table}{\numberline {2.5}{\ignorespaces Table showing common fields for creating an eBPF map.\relax }}{15}{table.caption.18}%
\contentsline {table}{\numberline {2.5}{\ignorespaces Common fields for creating an eBPF map.\relax }}{15}{table.caption.18}%
\defcounter {refsection}{0}\relax
\contentsline {table}{\numberline {2.6}{\ignorespaces Table showing types of eBPF maps. Only those used in our rootkit are displayed, the full list can be consulted in the man page \cite {bpf_syscall}\relax }}{15}{table.caption.19}%
\contentsline {table}{\numberline {2.6}{\ignorespaces Types of eBPF maps. Only those used in our rootkit are displayed, the full list can be consulted in the man page \cite {bpf_syscall}\relax }}{15}{table.caption.19}%
\defcounter {refsection}{0}\relax
\contentsline {table}{\numberline {2.7}{\ignorespaces Table showing types of syscall actions. Only those relevant to our research are shown the full list and attribute details can be consulted in the man page \cite {bpf_syscall}\relax }}{16}{table.caption.20}%
\contentsline {table}{\numberline {2.7}{\ignorespaces Types of syscall actions. Only those relevant to our research are shown the full list and attribute details can be consulted in the man page \cite {bpf_syscall}\relax }}{16}{table.caption.20}%
\defcounter {refsection}{0}\relax
\contentsline {table}{\numberline {2.8}{\ignorespaces Table showing types of eBPF programs. Only those relevant to our research are shown. The full list and attribute details can be consulted in the man page \cite {bpf_syscall}.\relax }}{17}{table.caption.21}%
\contentsline {table}{\numberline {2.8}{\ignorespaces Types of eBPF programs. Only those relevant to our research are shown. The full list and attribute details can be consulted in the man page \cite {bpf_syscall}.\relax }}{16}{table.caption.21}%
\defcounter {refsection}{0}\relax
\contentsline {table}{\numberline {2.9}{\ignorespaces Table showing common eBPF helpers. Only those relevant to our research are shown. Those helpers exclusive to an specific program type are not listed. The full list and attribute details can be consulted in the man page \cite {ebpf_helpers}.\relax }}{18}{table.caption.22}%
\contentsline {table}{\numberline {2.9}{\ignorespaces Common eBPF helpers. Only those relevant to our research are shown. Those helpers exclusive to an specific program type are not listed. The full list and attribute details can be consulted in the man page \cite {ebpf_helpers}.\relax }}{17}{table.caption.22}%
\defcounter {refsection}{0}\relax
\contentsline {table}{\numberline {2.10}{\ignorespaces Table showing XDP relevant return values.\relax }}{19}{table.caption.24}%
\contentsline {table}{\numberline {2.10}{\ignorespaces Relevant XDP return values.\relax }}{18}{table.caption.24}%
\defcounter {refsection}{0}\relax
\contentsline {table}{\numberline {2.11}{\ignorespaces Table showing relevant XDP-exclusive eBPF helpers.\relax }}{20}{table.caption.25}%
\contentsline {table}{\numberline {2.11}{\ignorespaces Relevant XDP-exclusive eBPF helpers.\relax }}{19}{table.caption.25}%
\defcounter {refsection}{0}\relax
\contentsline {table}{\numberline {2.12}{\ignorespaces Table showing TC relevant return values. Full list can be consulted at \cite {tc_ret_list_complete}.\relax }}{21}{table.caption.26}%
\contentsline {table}{\numberline {2.12}{\ignorespaces Relevant TC return values. Full list can be consulted at \cite {tc_ret_list_complete}.\relax }}{20}{table.caption.26}%
\defcounter {refsection}{0}\relax
\contentsline {table}{\numberline {2.13}{\ignorespaces Table showing relevant TC-exclusive eBPF helpers.\relax }}{21}{table.caption.27}%
\contentsline {table}{\numberline {2.13}{\ignorespaces Relevant TC-exclusive eBPF helpers.\relax }}{21}{table.caption.27}%
\defcounter {refsection}{0}\relax
\contentsline {table}{\numberline {2.14}{\ignorespaces Table showing BPF skeleton functions.\relax }}{25}{table.caption.29}%
\contentsline {table}{\numberline {2.14}{\ignorespaces BPF skeleton functions.\relax }}{25}{table.caption.29}%
\defcounter {refsection}{0}\relax
\contentsline {table}{\numberline {2.15}{\ignorespaces Kernel compilation flags for eBPF.\relax }}{26}{table.caption.30}%
\defcounter {refsection}{0}\relax
@@ -43,15 +43,15 @@
\defcounter {refsection}{0}\relax
\contentsline {table}{\numberline {2.19}{\ignorespaces Relevant TCP flags and their purpose.\relax }}{43}{table.caption.47}%
\defcounter {refsection}{0}\relax
\contentsline {table}{\numberline {2.20}{\ignorespaces Tools used for analysis of ELF programs.\relax }}{46}{table.caption.50}%
\contentsline {table}{\numberline {2.20}{\ignorespaces Tools used for analysis of ELF programs.\relax }}{45}{table.caption.50}%
\defcounter {refsection}{0}\relax
\contentsline {table}{\numberline {2.21}{\ignorespaces Tools used for analysis of ELF programs.\relax }}{47}{table.caption.51}%
\contentsline {table}{\numberline {2.21}{\ignorespaces Tools used for analysis of ELF programs.\relax }}{46}{table.caption.51}%
\defcounter {refsection}{0}\relax
\contentsline {table}{\numberline {2.22}{\ignorespaces Security features in C compilers used in the study.\relax }}{49}{table.caption.56}%
\contentsline {table}{\numberline {2.22}{\ignorespaces Security features in C compilers used in the study.\relax }}{48}{table.caption.56}%
\defcounter {refsection}{0}\relax
\addvspace {10\p@ }
\defcounter {refsection}{0}\relax
\contentsline {table}{\numberline {3.1}{\ignorespaces Argument passing convention of registers for function calls in user and kernel space respectively.\relax }}{54}{table.caption.57}%
\contentsline {table}{\numberline {3.1}{\ignorespaces Argument passing convention of registers for function calls in user and kernel space respectively.\relax }}{52}{table.caption.57}%
\defcounter {refsection}{0}\relax
\addvspace {10\p@ }
\defcounter {refsection}{0}\relax