Is there any method or technique that we can apply to traversaling linux's PCB??
Just like the title,i read <<Volatile Memory Computer Forensics to Detect Kernel Level Compromise>> by Sandra Ring and Eric Cole.He sugguest a method that can make all process zombie by traversal the process list. i thought a lot about this,but i can't understand how this can be done.How to trap into the kernel ? The protection mechanism? i need some fresh ideas ~~~~Thank you!
|