chainload

Chain loading LKM

(For example kmatryoshka used in reptile)

In order to provide an extra layer of obfuscation an LKM may chain load (aka "stacked load") additional code in module_init or otherwise perform actions before returning a non zero status to indicate module loading has failed. For example a first stage loader may decrypt a whole additional LKM module and load it from within the kernel.

Example

See kmatryohshka for a full example.

Detection

In the case of kmatryoshka it calls do_init_module with the decoded second stage so a kprobe there will catch it but this technique is more versatile and further thought should be given.