litemars/edrhookdetector

How litemars/edrhookdetector works

This is a Linux system-auditing CLI that detects userspace and kernel hook signals, then reports findings as text or JSON. The principal workflow is CLI selection → scoped scans → findings and verdict. Userspace checks cover inline patches, GOT/PLT hijacks, preload settings, and VDSO differences; kernel checks cover eBPF, probes, ftrace, LSMs, and module taint. Architecture-specific scoring and ELF validation support userspace analysis. Several subsystem details are documented in the README but not visible in sampled implementation excerpts; those links cite the README rather than implying the source was inspected.

Main entry points: main.c CLI and scope · common.c Inline patch scan · kernel_hooks.h Kernel scan interface · kernel_ebpf.c eBPF program scan

Components 22

Scan orchestration

CLI and scope src/main.c
Findings and verdict src/main.c

Userspace checks

Inline patch scan src/common.c
GOT/PLT scan src/common.c
Preload scan src/common.c
VDSO comparison src/common.c
Process and library discovery src/common.c

Kernel checks

eBPF program scan src/ebpf/kernel_ebpf.c
Kprobe scan src/kernel/kernel_hooks.c
Uprobe scan src/kernel/kernel_hooks.c
Ftrace scan src/kernel/kernel_hooks.c
Active LSM scan src/kernel/kernel_hooks.c
Tainted module scan src/kernel/kernel_hooks.c

Analysis internals

ELF validation src/elf_validation.h
x86 scoring and decode src/arch/arch_x86.c
x86 scoring interface src/arch/arch_x86.h
ARM64 hook scoring src/arch/arch_arm64.c
ARM64 scoring interface src/arch/arch_arm64.h
Shared scan types src/common.h
eBPF scan interface src/ebpf/kernel_ebpf.h
Kernel scan interface src/kernel/kernel_hooks.h

Other components

CLI user

Connections 35

CLI user → CLI and scope: selects scope README.md
CLI and scope → Process and library discovery: selects processes README.md
CLI and scope → Inline patch scan: runs userspace README.md
CLI and scope → GOT/PLT scan: runs userspace README.md
CLI and scope → Preload scan: runs userspace README.md
CLI and scope → VDSO comparison: runs userspace README.md
CLI and scope → eBPF program scan: runs kernel README.md
CLI and scope → Kprobe scan: runs kernel README.md
CLI and scope → Uprobe scan: runs kernel README.md
CLI and scope → Ftrace scan: runs kernel README.md
CLI and scope → Active LSM scan: runs kernel README.md
CLI and scope → Tainted module scan: runs kernel README.md
Inline patch scan → Findings and verdict: reports findings README.md
GOT/PLT scan → Findings and verdict: reports findings README.md
Preload scan → Findings and verdict: reports findings README.md
VDSO comparison → Findings and verdict: reports findings README.md
eBPF program scan → Findings and verdict: reports findings README.md
Kprobe scan → Findings and verdict: reports findings README.md
Uprobe scan → Findings and verdict: reports findings README.md
Ftrace scan → Findings and verdict: reports findings README.md
Active LSM scan → Findings and verdict: reports findings README.md
Tainted module scan → Findings and verdict: reports findings README.md
Inline patch scan → x86 scoring and decode: scores x86 bytes src/common.c
Inline patch scan → ARM64 hook scoring: scores ARM64 bytes src/common.c
Inline patch scan → ELF validation: validates ELF src/common.c
GOT/PLT scan → ELF validation: validates relocations src/common.c
x86 scoring and decode → x86 scoring interface: implements interface src/arch/arch_x86.c
ARM64 hook scoring → ARM64 scoring interface: implements interface src/arch/arch_arm64.c
Inline patch scan → Shared scan types: uses shared types src/common.c
eBPF program scan → eBPF scan interface: implements interface src/ebpf/kernel_ebpf.c
Kprobe scan → Kernel scan interface: declared by src/kernel/kernel_hooks.h
Uprobe scan → Kernel scan interface: declared by src/kernel/kernel_hooks.h
Ftrace scan → Kernel scan interface: declared by src/kernel/kernel_hooks.h
Active LSM scan → Kernel scan interface: declared by src/kernel/kernel_hooks.h
Tainted module scan → Kernel scan interface: declared by src/kernel/kernel_hooks.h

More C diagrams: cschpc/hop · daisy-model/daisy · extremq/lcd1602_i2c · mesmatmm/cs306-spring2025 · mightypancake/axo

Drawn by GitDiagram on September 30, 2026 from the repository's file tree, README and source files. Read as Markdown ·