Skip to content
/ ghost Public

ghost is a linux kernel module that allows clients to hide code modifications of infected applications via TLB desynchronization.

Notifications You must be signed in to change notification settings

gonzoj/ghost

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

1 Commit
 
 
 
 
 
 
 
 
 
 

Repository files navigation

A ghost in a shell

I developed this back in 2012 for the purpose of hiding Diablo III hacks that I never ended up finishing from warden. The module allows you to hide patches or injected code by loading addresses of clean frames into the DTLB for affected pages.

Back then it was built against the linux kernel 3.4.2. I assume it would require an update in order to work with recent kernels.

Clients can communicate with the module via the netlink subsystem. The header file provides a convenient API.

If you want to learn more about the concept of TLB desynchronization check out Shadow Walker.

About

ghost is a linux kernel module that allows clients to hide code modifications of infected applications via TLB desynchronization.

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published