Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I can get a list of modules using either lsmod or cat /proc/modules. Do the two approaches use the same mechanism to retrieve the modules? I want to know this as we could use it to find some hidden malicious modules.

share|improve this question
up vote 3 down vote accepted

They are both reading the same kernel interface to produce the list. However, a rootkit may alter lsmod to hide modules but there are myriad ways to read /proc/modules that would be near impossible for a rootkit to modify all of them.

If you're doing something programatic it doesn't really matter which one you use, but lsmod is much more human readable.

Update: To include examples.

cat /proc/modules
more /proc/modules
less /proc/modules
view /proc/modules
uniq /proc/moduels
uniq < /proc/modules
grep . /proc/modules
grep . < /proc/modules
awk '{print}' /proc/modules
awk '{print}' < /proc/modules
sed 's/(.)/$1/' < /proc/modules
echo "$(</proc/modules)"
perl -p -e ";" < /proc/modules
nc -l 11111 & nc localhost 11111 < /proc/modules

Etc., etc., etc. Anything that can read text can display the contents. These are just a few that I thought of in under a minute. If I thought about it I could come up with some really esoteric ways.

share|improve this answer
    
"there are myriad ways to read /proc/modules" could you please elaborate more on that? – user61954 Jan 9 '11 at 9:15
    
I'm not sure if you get notified that I edited my answer to include examples, but I did. – bahamat Jan 9 '11 at 9:41
    
Awesome man. Thanks for the info – user61954 Jan 9 '11 at 10:15

If the rootkit works at the kernel level (as a module for instance), you can not rely on the info provided by /proc/modules. Furthermore, you can not rely on lsmod either as it pretty-prints /proc/modules.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .