4 Star 6 Fork 2

DiDi-opensource / kemon

加入 Gitee
与超过 600 万 开发者一起发现、参与优秀开源项目,私有仓库也完全免费 :)
免费加入
克隆/下载
取消
提示: 由于 Git 不支持空文件夾,创建文件夹后会生成空的 .keep 文件
Loading...
README.md

Kemon

An Open-Source Pre and Post Callback-Based Framework for macOS Kernel Monitoring.

What is Kemon?

An open-source Pre and Post callback-based framework for macOS kernel monitoring. With the power of Kemon, we can easily implement LPC communication monitoring, MAC policy filtering, kernel driver firewall, etc. In general, from an attacker's perspective, this framework can help achieve more powerful Rootkit. From the perspective of defense, Kemon can help construct more granular monitoring capabilities. I also implemented a kernel fuzzer through this framework, which helped me find many vulnerabilities, such as: CVE-2017-7155, CVE-2017-7163, CVE-2017-13883, etc.

Supported Features

Kemon's features include:

  • file operation monitoring
  • process creation monitoring
  • dynamic library and kernel extension monitoring
  • network traffic monitoring
  • Mandatory Access Control (MAC) policy monitoring, etc.

In addition, Kemon project can also extend the Pre and Post callback-based monitoring interfaces for any macOS kernel function.

Getting Started

How to build the Kemon driver

Please use Xcode project or makefile to build the Kemon kext driver

How to use the Kemon driver

  • Please turn off macOS System Integrity Protection (SIP) check if you don't have a valid kernel certificate
  • Use the command "sudo chown -R root:wheel kemon.kext" to change the owner of the Kemon driver
  • Use the command "sudo kextload kemon.kext" to install the Kemon driver
  • Use the command "sudo kextunload kemon.kext" to uninstall the Kemon driver

Contributing

Welcome to contribute by creating issues or sending pull requests. See Contributing Guide for guidelines.

License

Kemon is licensed under the Apache License 2.0. See the LICENSE file.

点评 ( 0 )

你可以在登录后,发表评论

简介

Kemon 是滴滴开源的一款用于 macOS 内核监控的前后回调框架 展开 收起
C 等 3 种语言
Apache-2.0
取消

发行版

暂无发行版

kemon

贡献者

全部

近期动态

加载更多
不能加载更多了
C
1
https://gitee.com/didiopensource/kemon.git
git@gitee.com:didiopensource/kemon.git
didiopensource
kemon
kemon
master

搜索帮助