4 Unstar Star 5 Fork 1

DiDi-opensource / kemon

Create your Gitee Account
Explore and code with more than 5 million developers,Free private repositories !:)
Sign up
Clone or download
Cancel
Notice: Creating folder will generate an empty file .keep, because not support in Git
Loading...
README.md

Kemon

An Open-Source Pre and Post Callback-Based Framework for macOS Kernel Monitoring.

What is Kemon?

An open-source Pre and Post callback-based framework for macOS kernel monitoring. With the power of Kemon, we can easily implement LPC communication monitoring, MAC policy filtering, kernel driver firewall, etc. In general, from an attacker's perspective, this framework can help achieve more powerful Rootkit. From the perspective of defense, Kemon can help construct more granular monitoring capabilities. I also implemented a kernel fuzzer through this framework, which helped me find many vulnerabilities, such as: CVE-2017-7155, CVE-2017-7163, CVE-2017-13883, etc.

Supported Features

Kemon's features include:

  • file operation monitoring
  • process creation monitoring
  • dynamic library and kernel extension monitoring
  • network traffic monitoring
  • Mandatory Access Control (MAC) policy monitoring, etc.

In addition, Kemon project can also extend the Pre and Post callback-based monitoring interfaces for any macOS kernel function.

Getting Started

How to build the Kemon driver

Please use Xcode project or makefile to build the Kemon kext driver

How to use the Kemon driver

  • Please turn off macOS System Integrity Protection (SIP) check if you don't have a valid kernel certificate
  • Use the command "sudo chown -R root:wheel kemon.kext" to change the owner of the Kemon driver
  • Use the command "sudo kextload kemon.kext" to install the Kemon driver
  • Use the command "sudo kextunload kemon.kext" to uninstall the Kemon driver

Contributing

Welcome to contribute by creating issues or sending pull requests. See Contributing Guide for guidelines.

License

Kemon is licensed under the Apache License 2.0. See the LICENSE file.

Comments ( 0 )

Sign in for post a comment

About

Kemon 是滴滴开源的一款用于 macOS 内核监控的前后回调框架 spread retract
C and 3 more languages
Apache-2.0
Cancel

Releases

No release

Gitee Metrics

Contributors

All

Activities

load more
can not load any more
C
1
https://git.oschina.net/didiopensource/kemon.git
git@git.oschina.net:didiopensource/kemon.git
didiopensource
kemon
kemon
master

Search

132457 8cb2edc1 1899542 131848 70c8d3a4 1899542