	AIRT --	Advanced Incident Response Tool

	Developed and maintained by madsys, coolq


[1] What is AIRT?
[2] How can I use it?
[3] Where can I get the lastest version?
[4] How can I report a bug?


[1] What is AIRT?
--------------------

	AIRT(Advanced incident response tool) is a set of incident response assistant tools on linux platform. It's useful when you want to know what evil program is still resident on your broken system and what the hell it is. It consists of 5 useful tool:

mod_hunter: looks for hidden module on the suspect system.

process_hunter: looks for hidden process from kernel on the suspect system.

sock_hunter: looks for hidden port from kernel on the suspect system (only support IPv4 now).

modumper: dumps the hidden module into file.

dismod: trys to analyze the dumped module (you should use dismod.pl instead of dismod)


Note: it only supports 2.6 kernel now, will support 2.4 kernel later.


[2] How can I use it?
----------------------

	Unpack the compressed sources, enter the top directory and just execute:

	make;

	if u want to check if there is hidden module in your system:
	insmod mod_hunter.[k]o && cat /proc/showmodules

	if u want to check if there is hidden process in your system:
	insmod process_hunter.[k]o && cat /proc/showprocess

	if u want to check if there is hidden port in your system:
	insmod port_hunter.[k]o && cat /proc/showsocks

	if u want to dump the module:
	enter the mod_dumper directory and
	insmod modumper.[k]o mod_name=MODULE && cat /proc/get_mod
	it will dump the module automatically into dump.dat & dump.info

	if u want to analyze the dumped module:
	./dismod.pl (use the perl scritp instead of the dismod binary!)


[3] Where can I get the last version?
-----------------------------------------

	http://159.226.5.93/projects/airt.htm


[4] How can I report a bug?
----------------------------

	we are glad to recieve the bug report.
	any comments && bugs && suggestion mail to: 
	madsys@ericst.iscas.ac.cn
	sec_user@ericst.iscas.ac.cn