What happens when an attacker's LKM is inoculated into your
system ? Mostly you will not be able to trust the kernel
anymore.

But the worst is you could as well NOT discover the LKM has
been implanted. kstat may help by probing for the addressess
of all sys_calls, which are usually hijacked via pointers
to the sys_call_table. By comparing an up-tp-date System.map
file and probed table via /dev/kmem, we can assure if sys_calls
are where they should be.

Eg:

SLaCKy:~/KSTAT# ./kstat -s

(snip)

SysCall sys_creat found at 0xc01231c4
SysCall sys_link found at 0xc012ad6c
SysCall sys_unlink found at 0xc283838c WARNING! Should be at 0xc012abb8
SysCall sys_execve found at 0xc2838168 WARNING! Should be at 0xc01076c4
SysCall sys_chdir found at 0xc2838440 WARNING! Should be at 0xc0122a08
SysCall sys_time found at 0xc0116858
SysCall sys_mknod found at 0xc012a6f0

(snip)

SysCall sys_ioctl found at 0xc2838604 WARNING! Should be at 0xc012bfb4
SysCall sys_fcntl found at 0xc012ba00

(snip)

SysCall sys_ioperm found at 0xc010b94c
SysCall sys_socketcall found at 0xc2838730 WARNING! Should be at 0xc01534b0
SysCall sys_syslog found at 0xc011269c

(snip)

SysCall sys_vm86 found at 0xc0109e70
SysCall sys_query_module found at 0xc28388bc WARNING! Should be at 0xc0115058
SysCall sys_poll found at 0xc012cdec

...

sys_query_module is, BTW, probably hijacked to prevent lsmod to show the
rogue LKM. So we can try to locate it as well.
