package kernel

import (
	"bytes"
	"encoding/binary"
	"errors"
)

type RootkitRule struct {
	Name  string
	File  []string
	Dir   []string
	Ksyms []string
}

const (
	DefaultDescription = "rootkit backdoor"
	KallsymsPath       = "/proc/kallsyms"
	KcorePath          = "/proc/kcore"
	KernelModulesPath  = "/proc/modules"
	VersionPath        = "/proc/version"
	LKMDir             = "/lib/modules/"

	MaxInt64         = int64(1<<63 - 1)
	ModuleOffset     = 0x90
	MaxZeroAddresses = 20
)

var (
	ErrInvalidAddr   = errors.New("address should start with '0x")
	ErrInvalidKsyms  = errors.New("parse kallsyms line failed")
	ErrInvalidNum    = errors.New("binary search returned a negative number")
	ErrKallsymsInit  = errors.New("kallsyms init failed")
	ErrKcoreInit     = errors.New("kcore init failed")
	ErrKallsymsAddr  = errors.New("too many zero addresses in kallsyms")
	ErrModulesAddr   = errors.New("too many zero addresses")
	ErrNoModule      = errors.New("cant find modules")
	ErrSizeMissMatch = errors.New("read size does not match the requested size")
	ErrTooBig        = errors.New("read addr too big, max 0x800000000000")
	ErrVersion       = errors.New("unable to find correct kernel version in /proc/version")
)

var (
	BadLKM = []string{
		"adore",
		"bkit-adore",
		"cleaner",
		"flkm",
		"knark",
		"mod_klgr",
		"modhide",
		"p2",
		"phide_mod",
		"rpldev",
		"strings",
		"vlogger",
		"wkmr26",
		"xC",
	}

	SymsBuiltinList = []string{
		"_text",
		"ext4_dir_operations",
		"ext4_file_operations",
		"proc_root_operations",
		"proc_root_operations",
		"proc_root_readdir",
		"sys_call_table",
		"tcp4_seq_afinfo",
	}

	RootkitRules = []*RootkitRule{
		{
			Name: "55808 Variant A",
			File: []string{
				"/tmp/.../r",
				"/tmp/.../a",
			},
			Dir:   []string{},
			Ksyms: []string{},
		},
		{
			Name: "Adore Rootkit",
			File: []string{
				"/usr/secure",
				"/usr/doc/sys/qrt",
				"/usr/doc/sys/run",
				"/usr/doc/sys/crond",
				"/usr/sbin/kfd",
				"/usr/doc/kern/var",
				"/usr/doc/kern/string.o",
				"/usr/doc/kern/ava",
				"/usr/doc/kern/adore.o",
				"/var/log/ssh/old",
			},
			Dir: []string{
				"/lib/security/.config/ssh",
				"/usr/doc/kern",
				"/usr/doc/backup",
				"/usr/doc/backup/txt",
				"/lib/backup",
				"/lib/backup/txt",
				"/usr/doc/work",
				"/usr/doc/sys",
				"/var/log/ssh",
				"/usr/doc/.spool",
				"/usr/lib/kterm",
			},
			Ksyms: []string{},
		},
		{
			Name: "AjaKit Rootkit",
			File: []string{
				"/dev/tux/.addr",
				"/dev/tux/.proc",
				"/dev/tux/.file",
				"/lib/.libgh-gh/cleaner",
				"/lib/.libgh-gh/Patch/patch",
				"/lib/.libgh-gh/sb0k",
			},
			Dir: []string{
				"/dev/tux",
				"/lib/.libgh-gh",
			},
			Ksyms: []string{},
		},
		{
			Name: "aPa Kit Rootkit",
			File: []string{
				"/usr/share/.aPa",
			},
			Dir:   []string{},
			Ksyms: []string{},
		},
		{
			Name: "Apache Worm",
			File: []string{
				"/bin/.log",
			},
			Dir:   []string{},
			Ksyms: []string{},
		},
		{
			Name: "Ambient Rootkit",
			File: []string{
				"/usr/lib/.ark?",
				"/dev/ptyxx/.log",
				"/dev/ptyxx/.file",
				"/dev/ptyxx/.proc",
				"/dev/ptyxx/.addr",
			},
			Dir: []string{
				"/dev/ptyxx",
			},
			Ksyms: []string{},
		},
		{
			Name: "Balaur Rootkit",
			File: []string{
				"/usr/lib/liblog.o",
			},
			Dir: []string{
				"/usr/lib/.kinetic",
				"/usr/lib/.egcs",
				"/usr/lib/.wormie",
			},
			Ksyms: []string{},
		},
		{
			Name: "Beastkit Rootkit",
			File: []string{
				"/usr/sbin/arobia",
				"/usr/sbin/idrun",
				"/usr/lib/elm/arobia/elm",
				"/usr/lib/elm/arobia/elm/hk",
				"/usr/lib/elm/arobia/elm/hk.pub",
				"/usr/lib/elm/arobia/elm/sc",
				"/usr/lib/elm/arobia/elm/sd.pp",
				"/usr/lib/elm/arobia/elm/sdco",
				"/usr/lib/elm/arobia/elm/srsd",
			},
			Dir: []string{
				"/lib/ldd.so/bktools",
			},
			Ksyms: []string{},
		},
		{
			Name: "beX2 Rootkit",
			File: []string{
				"/usr/info/termcap.info-5.gz",
				"/usr/bin/sshd2",
			},
			Dir: []string{
				"/usr/include/bex",
			},
			Ksyms: []string{},
		},
		{
			Name: "BOBkit Rootkit",
			File: []string{
				"/usr/sbin/ntpsx",
				"/usr/sbin/.../bkit-ava",
				"/usr/sbin/.../bkit-d",
				"/usr/sbin/.../bkit-shd",
				"/usr/sbin/.../bkit-f",
				"/usr/include/.../proc.h",
				"/usr/include/.../.bash_history",
				"/usr/include/.../bkit-get",
				"/usr/include/.../bkit-dl",
				"/usr/include/.../bkit-screen",
				"/usr/include/.../bkit-sleep",
				"/usr/lib/.../bkit-adore.o",
				"/usr/lib/.../ls",
				"/usr/lib/.../netstat",
				"/usr/lib/.../lsof",
				"/usr/lib/.../bkit-ssh/bkit-shdcfg",
				"/usr/lib/.../bkit-ssh/bkit-shhk",
				"/usr/lib/.../bkit-ssh/bkit-pw",
				"/usr/lib/.../bkit-ssh/bkit-shrs",
				"/usr/lib/.../bkit-ssh/bkit-mots",
				"/usr/lib/.../uconf.inv",
				"/usr/lib/.../psr",
				"/usr/lib/.../find",
				"/usr/lib/.../pstree",
				"/usr/lib/.../slocate",
				"/usr/lib/.../du",
				"/usr/lib/.../top",
			},
			Dir: []string{
				"/usr/sbin/...",
				"/usr/include/...",
				"/usr/include/.../.tmp",
				"/usr/lib/...",
				"/usr/lib/.../.ssh",
				"/usr/lib/.../bkit-ssh",
				"/usr/lib/.bkit-",
				"/tmp/.bkp",
			},
			Ksyms: []string{},
		},
		{
			Name: "OSX Boonana-A Trojan",
			File: []string{
				"/Library/StartupItems/OSXDriverUpdates/OSXDriverUpdates",
				"/Library/StartupItems/OSXDriverUpdates/StartupParameters.plist",
			},
			Dir: []string{
				"/var/root/.jnana",
			},
			Ksyms: []string{},
		},
		{
			Name: "cb Rootkit",
			File: []string{
				"/dev/srd0",
				"/lib/libproc.so.2.0.6",
				"/dev/mounnt",
				"/etc/rc.d/init.d/init",
				"/usr/bin/.zeen/..%/cl",
				"/usr/bin/.zeen/..%/.x.tgz",
				"/usr/bin/.zeen/..%/statdx",
				"/usr/bin/.zeen/..%/wted",
				"/usr/bin/.zeen/..%/write",
				"/usr/bin/.zeen/..%/scan",
				"/usr/bin/.zeen/..%/sc",
				"/usr/bin/.zeen/..%/sl2",
				"/usr/bin/.zeen/..%/wroot",
				"/usr/bin/.zeen/..%/wscan",
				"/usr/bin/.zeen/..%/wu",
				"/usr/bin/.zeen/..%/v",
				"/usr/bin/.zeen/..%/read",
				"/usr/lib/sshrc",
				"/usr/lib/ssh_host_key",
				"/usr/lib/ssh_host_key.pub",
				"/usr/lib/ssh_random_seed",
				"/usr/lib/sshd_config",
				"/usr/lib/shosts.equiv",
				"/usr/lib/ssh_known_hosts",
				"/u/zappa/.ssh/pid",
				"/usr/bin/.system/..%/tcp.log",
				"/usr/bin/.zeen/..%/curatare/attrib",
				"/usr/bin/.zeen/..%/curatare/chattr",
				"/usr/bin/.zeen/..%/curatare/ps",
				"/usr/bin/.zeen/..%/curatare/pstree",
				"/usr/bin/.system/..%/.x/xC.o",
			},
			Dir: []string{
				"/usr/bin/.zeen",
				"/usr/bin/.zeen/..%/curatare",
				"/usr/bin/.zeen/..%/scan",
				"/usr/bin/.system/..%",
			},
			Ksyms: []string{},
		},
		{
			Name: "CiNIK Worm",
			File: []string{
				"/tmp/.cinik",
			},
			Dir: []string{
				"/tmp/.font-unix/.cinik",
			},
			Ksyms: []string{},
		},
		{
			Name: "CX Rootkit",
			File: []string{
				"/usr/lib/ldlibso",
				"/usr/lib/configlibso",
				"/usr/lib/shklibso",
				"/usr/lib/randomlibso",
				"/usr/lib/ldlibstrings.so",
				"/usr/lib/ldlibdu.so",
				"/usr/lib/ldlibns.so",
				"/usr/include/db",
			},
			Dir: []string{
				"/usr/include/cxk",
			},
			Ksyms: []string{},
		},
		{
			Name: "Abuse Kit",
			File: []string{
				"/dev/mdev",
				"/usr/lib/libX.a",
			},
			Dir:   []string{},
			Ksyms: []string{},
		},
		{
			Name: "Devil Rootkit",
			File: []string{
				"/var/lib/games/.src",
				"/dev/dsx",
				"/dev/caca",
				"/dev/pro",
				"/bin/bye",
				"/bin/homedir",
				"/usr/bin/xfss",
				"/usr/sbin/tzava",
				"/usr/doc/tar/.../.dracusor/stuff/holber",
				"/usr/doc/tar/.../.dracusor/stuff/sense",
				"/usr/doc/tar/.../.dracusor/stuff/clear",
				"/usr/doc/tar/.../.dracusor/stuff/tzava",
				"/usr/doc/tar/.../.dracusor/stuff/citeste",
				"/usr/doc/tar/.../.dracusor/stuff/killrk",
				"/usr/doc/tar/.../.dracusor/stuff/searchlog",
				"/usr/doc/tar/.../.dracusor/stuff/gaoaza",
				"/usr/doc/tar/.../.dracusor/stuff/cleaner",
				"/usr/doc/tar/.../.dracusor/stuff/shk",
				"/usr/doc/tar/.../.dracusor/stuff/srs",
				"/usr/doc/tar/.../.dracusor/utile.tgz",
				"/usr/doc/tar/.../.dracusor/webpage",
				"/usr/doc/tar/.../.dracusor/getpsy",
				"/usr/doc/tar/.../.dracusor/getbnc",
				"/usr/doc/tar/.../.dracusor/getemech",
				"/usr/doc/tar/.../.dracusor/localroot.sh",
				"/usr/doc/tar/.../.dracusor/stuff/old/sense",
			},
			Dir: []string{
				"/usr/doc/tar/.../.dracusor",
			},
			Ksyms: []string{},
		},
		{
			Name: "Diamorphine LKM",
			File: []string{},
			Dir:  []string{},
			Ksyms: []string{
				"diamorphine",
				"module_hide",
				"module_hidden",
				"is_invisible",
				"hacked_getdents",
				"hacked_kill",
			},
		},
		{
			Name: "Dica-Kit Rootkit",
			File: []string{
				"/lib/.sso",
				"/lib/.so",
				"/var/run/...dica/clean",
				"/var/run/...dica/dxr",
				"/var/run/...dica/read",
				"/var/run/...dica/write",
				"/var/run/...dica/lf",
				"/var/run/...dica/xl",
				"/var/run/...dica/xdr",
				"/var/run/...dica/psg",
				"/var/run/...dica/secure",
				"/var/run/...dica/rdx",
				"/var/run/...dica/va",
				"/var/run/...dica/cl.sh",
				"/var/run/...dica/last.log",
				"/usr/bin/.etc",
				"/etc/sshd_config",
				"/etc/ssh_host_key",
				"/etc/ssh_random_seed",
			},
			Dir: []string{
				"/var/run/...dica",
				"/var/run/...dica/mh",
				"/var/run/...dica/scan",
			},
			Ksyms: []string{},
		},
		{
			Name: "Dreams Rootkit",
			File: []string{
				"/dev/ttyoa",
				"/dev/ttyof",
				"/dev/ttyop",
				"/usr/bin/sense",
				"/usr/bin/sl2",
				"/usr/bin/logclear",
				"/usr/bin/(swapd)",
				"/usr/bin/initrd",
				"/usr/bin/crontabs",
				"/usr/bin/snfs",
				"/usr/lib/libsss",
				"/usr/lib/libsnf.log",
				"/usr/lib/libshtift/top",
				"/usr/lib/libshtift/ps",
				"/usr/lib/libshtift/netstat",
				"/usr/lib/libshtift/ls",
				"/usr/lib/libshtift/ifconfig",
				"/usr/include/linseed.h",
				"/usr/include/linpid.h",
				"/usr/include/linkey.h",
				"/usr/include/linconf.h",
				"/usr/include/iceseed.h",
				"/usr/include/icepid.h",
				"/usr/include/icekey.h",
				"/usr/include/iceconf.h",
			},
			Dir: []string{
				"/dev/ida/.hpd",
				"/usr/lib/libshtift",
			},
			Ksyms: []string{},
		},
		{
			Name: "Duarawkz Rootkit",
			File: []string{
				"/usr/bin/duarawkz/loginpass",
			},
			Dir: []string{
				"/usr/bin/duarawkz",
			},
			Ksyms: []string{},
		},
		{
			Name: "Ebury sshd backdoor",
			File: []string{
				"/lib/libns2.so",
				"/lib64/libns2.so",
				"/lib/libns5.so",
				"/lib64/libns5.so",
				"/lib/libpw3.so",
				"/lib64/libpw3.so",
				"/lib/libpw5.so",
				"/lib64/libpw5.so",
				"/lib/libsbr.so",
				"/lib64/libsbr.so",
				"/lib/libslr.so",
				"/lib64/libslr.so",
				"/lib/tls/libkeyutils.so.1",
				"/lib64/tls/libkeyutils.so.1",
			},
			Dir:   []string{},
			Ksyms: []string{},
		},
		{
			Name: "ENYE LKM",
			File: []string{
				"/etc/.enyelkmHIDE^IT.ko",
				"/etc/.enyelkmOCULTAR.ko",
			},
			Dir:   []string{},
			Ksyms: []string{},
		},
		{
			Name: "Flea Rootkit",
			File: []string{
				"/etc/ld.so.hash",
				"/lib/security/.config/ssh/sshd_config",
				"/lib/security/.config/ssh/ssh_host_key",
				"/lib/security/.config/ssh/ssh_host_key.pub",
				"/lib/security/.config/ssh/ssh_random_seed",
				"/usr/bin/ssh2d",
				"/usr/lib/ldlibns.so",
				"/usr/lib/ldlibps.so",
				"/usr/lib/ldlibpst.so",
				"/usr/lib/ldlibdu.so",
				"/usr/lib/ldlibct.so",
			},
			Dir: []string{
				"/lib/security/.config/ssh",
				"/dev/..0",
				"/dev/..0/backup",
			},
			Ksyms: []string{},
		},
		{
			Name: "FreeBSD Rootkit",
			File: []string{
				"/dev/ptyp",
				"/dev/ptyq",
				"/dev/ptyr",
				"/dev/ptys",
				"/dev/ptyt",
				"/dev/fd/.88/freshb-bsd",
				"/dev/fd/.88/fresht",
				"/dev/fd/.88/zxsniff",
				"/dev/fd/.88/zxsniff.log",
				"/dev/fd/.99/.ttyf00",
				"/dev/fd/.99/.ttyp00",
				"/dev/fd/.99/.ttyq00",
				"/dev/fd/.99/.ttys00",
				"/dev/fd/.99/.pwsx00",
				"/etc/.acid",
				"/usr/lib/.fx/sched_host.2",
				"/usr/lib/.fx/random_d.2",
				"/usr/lib/.fx/set_pid.2",
				"/usr/lib/.fx/setrgrp.2",
				"/usr/lib/.fx/TOHIDE",
				"/usr/lib/.fx/cons.saver",
				"/usr/lib/.fx/adore/ava/ava",
				"/usr/lib/.fx/adore/adore/adore.ko",
				"/bin/sysback",
				"/usr/local/bin/sysback",
			},
			Dir: []string{
				"/dev/fd/.88",
				"/dev/fd/.99",
				"/usr/lib/.fx",
				"/usr/lib/.fx/adore",
			},
			Ksyms: []string{},
		},
		{
			Name: "Fu Rootkit",
			File: []string{
				"/sbin/xc",
				"/usr/include/ivtype.h",
				"/bin/.lib",
			},
			Dir:   []string{},
			Ksyms: []string{},
		},
		{
			Name: "Fuckit Rootkit",
			File: []string{
				"/lib/libproc.so.2.0.7",
				"/dev/proc/.bash_profile",
				"/dev/proc/.bashrc",
				"/dev/proc/.cshrc",
				"/dev/proc/fuckit/hax0r",
				"/dev/proc/fuckit/hax0rshell",
				"/dev/proc/fuckit/config/lports",
				"/dev/proc/fuckit/config/rports",
				"/dev/proc/fuckit/config/rkconf",
				"/dev/proc/fuckit/config/password",
				"/dev/proc/fuckit/config/progs",
				"/dev/proc/fuckit/system-bins/init",
				"/usr/lib/libcps.a",
				"/usr/lib/libtty.a",
			},
			Dir: []string{
				"/dev/proc",
				"/dev/proc/fuckit",
				"/dev/proc/fuckit/system-bins",
				"/dev/proc/toolz",
			},
			Ksyms: []string{},
		},
		{
			Name: "GasKit Rootkit",
			File: []string{
				"/dev/dev/gaskit/sshd/sshdd",
			},
			Dir: []string{
				"/dev/dev",
				"/dev/dev/gaskit",
				"/dev/dev/gaskit/sshd",
			},
			Ksyms: []string{},
		},
		{
			Name: "Heroin LKM",
			File: []string{},
			Dir:  []string{},
			Ksyms: []string{
				"heroin",
			},
		},
		{
			Name: "HjC Kit Rootkit",
			File: []string{},
			Dir: []string{
				"/dev/.hijackerz",
			},
			Ksyms: []string{},
		},
		{
			Name: "ignoKit Rootkit",
			File: []string{
				"/lib/defs/p",
				"/lib/defs/q",
				"/lib/defs/r",
				"/lib/defs/s",
				"/lib/defs/t",
				"/usr/lib/defs/p",
				"/usr/lib/defs/q",
				"/usr/lib/defs/r",
				"/usr/lib/defs/s",
				"/usr/lib/defs/t",
				"/usr/lib/.libigno/pkunsec",
				"/usr/lib/.libigno/.igno/psybnc/psybnc",
			},
			Dir: []string{
				"/usr/lib/.libigno",
				"/usr/lib/.libigno/.igno",
			},
			Ksyms: []string{},
		},
		{
			Name: "iLLogiC Rootkit",
			File: []string{
				"/dev/kmod",
				"/dev/dos",
				"/usr/lib/crth.o",
				"/usr/lib/crtz.o",
				"/etc/ld.so.hash",
				"/usr/bin/sia",
				"/usr/bin/ssh2d",
				"/lib/security/.config/sn",
				"/lib/security/.config/iver",
				"/lib/security/.config/uconf.inv",
				"/lib/security/.config/ssh/ssh_host_key",
				"/lib/security/.config/ssh/ssh_host_key.pub",
				"/lib/security/.config/ssh/sshport",
				"/lib/security/.config/ssh/ssh_random_seed",
				"/lib/security/.config/ava",
				"/lib/security/.config/cleaner",
				"/lib/security/.config/lpsched",
				"/lib/security/.config/sz",
				"/lib/security/.config/rcp",
				"/lib/security/.config/patcher",
				"/lib/security/.config/pg",
				"/lib/security/.config/crypt",
				"/lib/security/.config/utime",
				"/lib/security/.config/wget",
				"/lib/security/.config/instmod",
				"/lib/security/.config/bin/find",
				"/lib/security/.config/bin/du",
				"/lib/security/.config/bin/ls",
				"/lib/security/.config/bin/psr",
				"/lib/security/.config/bin/netstat",
				"/lib/security/.config/bin/su",
				"/lib/security/.config/bin/ping",
				"/lib/security/.config/bin/passwd",
			},
			Dir: []string{
				"/lib/security/.config",
				"/lib/security/.config/ssh",
				"/lib/security/.config/bin",
				"/lib/security/.config/backup",
				"/root/%%%/.dir",
				"/root/%%%/.dir/mass-scan",
				"/root/%%%/.dir/flood",
			},
			Ksyms: []string{},
		},
		{
			Name: "OSX Inqtana Variant A",
			File: []string{
				"/Users/w0rm-support.tgz",
				"/Users/InqTest.class",
				"/Users/com.openbundle.plist",
				"/Users/com.pwned.plist",
				"/Users/libavetanaBT.jnilib",
			},
			Dir: []string{
				"/Users/de",
				"/Users/javax",
			},
			Ksyms: []string{},
		},
		{
			Name: "OSX Inqtana Variant B",
			File: []string{
				"/Users/w0rms.love.apples.tgz",
				"/Users/InqTest.class",
				"/Users/InqTest.java",
				"/Users/libavetanaBT.jnilib",
				"/Users/InqTanaHandler",
				"/Users/InqTanaHandler.bundle",
			},
			Dir: []string{
				"/Users/de",
				"/Users/javax",
			},
			Ksyms: []string{},
		},
		{
			Name: "OSX Inqtana Variant C",
			File: []string{
				"/Users/applec0re.tgz",
				"/Users/InqTest.class",
				"/Users/InqTest.java",
				"/Users/libavetanaBT.jnilib",
				"/Users/environment.plist",
				"/Users/pwned.c",
				"/Users/pwned.dylib",
			},
			Dir: []string{
				"/Users/de",
				"/Users/javax",
			},
			Ksyms: []string{},
		},
		{
			Name: "IntoXonia-NG Rootkit",
			File: []string{},
			Dir:  []string{},
			Ksyms: []string{
				"funces",
				"ixinit",
				"tricks",
				"kernel_unlink",
				"rootme",
				"hide_module",
				"find_sys_call_tbl",
			},
		},
		{
			Name: "Irix Rootkit",
			File: []string{},
			Dir: []string{
				"/dev/pts/01",
				"/dev/pts/01/backup",
				"/dev/pts/01/etc",
				"/dev/pts/01/tmp",
			},
			Ksyms: []string{},
		},
		{
			Name: "Jynx Rootkit",
			File: []string{
				"/xochikit/bc",
				"/xochikit/ld_poison.so",
				"/omgxochi/bc",
				"/omgxochi/ld_poison.so",
				"/var/local/^^/bc",
				"/var/local/^^/ld_poison.so",
			},
			Dir: []string{
				"/xochikit",
				"/omgxochi",
				"/var/local/^^",
			},
			Ksyms: []string{},
		},
		{
			Name: "Jynx2 Rootkit",
			File: []string{
				"/XxJynx/reality.so",
			},
			Dir: []string{
				"/XxJynx",
			},
			Ksyms: []string{},
		},
		{
			Name: "KBeast Rootkit",
			File: []string{
				"/usr/_h4x_/ipsecs-kbeast-v1.ko",
				"/usr/_h4x_/_h4x_bd",
				"/usr/_h4x_/acctlog",
			},
			Dir: []string{
				"/usr/_h4x_",
			},
			Ksyms: []string{
				"h4x_delete_module",
				"h4x_getdents64",
				"h4x_kill",
				"h4x_open",
				"h4x_read",
				"h4x_rename",
				"h4x_rmdir",
				"h4x_tcp4_seq_show",
				"h4x_write",
			},
		},
		{
			Name: "OSX Keydnap backdoor",
			File: []string{
				"/Applications/Transmission.app/Contents/Resources/License.rtf",
				"/Volumes/Transmission/Transmission.app/Contents/Resources/License.rtf",
				"/Library/LaunchAgents/com.apple.iCloud.sync.daemon.plist",
				"/Library/LaunchAgents/com.geticloud.icloud.photo.plist",
			},
			Dir: []string{
				"/Library/Application%Support/com.apple.iCloud.sync.daemon/",
			},
			Ksyms: []string{},
		},
		{
			Name: "Kitko Rootkit",
			File: []string{},
			Dir: []string{
				"/usr/src/redhat/SRPMS/...",
			},
			Ksyms: []string{},
		},
		{
			Name: "Knark Rootkit",
			File: []string{
				"/proc/knark/pids",
			},
			Dir: []string{
				"/proc/knark",
			},
			Ksyms: []string{},
		},
		{
			Name: "OSX Komplex Trojan",
			File: []string{
				"/Users/Shared/.local/kextd",
				"/Users/Shared/com.apple.updates.plist",
				"/Users/Shared/start.sh",
			},
			Dir:   []string{},
			Ksyms: []string{},
		},
		{
			Name: "ld-linuxv rootkit",
			File: []string{
				"/lib/ld-linuxv.so.1",
			},
			Dir: []string{
				"/var/opt/_so_cache",
				"/var/opt/_so_cache/ld",
				"/var/opt/_so_cache/lc",
			},
			Ksyms: []string{},
		},
		{
			Name: "Lion Worm",
			File: []string{
				"/bin/in.telnetd",
				"/bin/mjy",
				"/usr/man/man1/man1/lib/.lib/mjy",
				"/usr/man/man1/man1/lib/.lib/in.telnetd",
				"/usr/man/man1/man1/lib/.lib/.x",
				"/dev/.lib/lib/scan/1i0n.sh",
				"/dev/.lib/lib/scan/hack.sh",
				"/dev/.lib/lib/scan/bind",
				"/dev/.lib/lib/scan/randb",
				"/dev/.lib/lib/scan/scan.sh",
				"/dev/.lib/lib/scan/pscan",
				"/dev/.lib/lib/scan/star.sh",
				"/dev/.lib/lib/scan/bindx.sh",
				"/dev/.lib/lib/scan/bindname.log",
				"/dev/.lib/lib/1i0n.sh",
				"/dev/.lib/lib/lib/netstat",
				"/dev/.lib/lib/lib/dev/.1addr",
				"/dev/.lib/lib/lib/dev/.1logz",
				"/dev/.lib/lib/lib/dev/.1proc",
				"/dev/.lib/lib/lib/dev/.1file",
			},
			Dir:   []string{},
			Ksyms: []string{},
		},
		{
			Name: "Lockit Rootkit",
			File: []string{
				"/usr/lib/libmen.oo/.LJK2/ssh_config",
				"/usr/lib/libmen.oo/.LJK2/ssh_host_key",
				"/usr/lib/libmen.oo/.LJK2/ssh_host_key.pub",
				"/usr/lib/libmen.oo/.LJK2/ssh_random_seed*",
				"/usr/lib/libmen.oo/.LJK2/sshd_config",
				"/usr/lib/libmen.oo/.LJK2/backdoor/RK1bd",
				"/usr/lib/libmen.oo/.LJK2/backup/du",
				"/usr/lib/libmen.oo/.LJK2/backup/ifconfig",
				"/usr/lib/libmen.oo/.LJK2/backup/inetd.conf",
				"/usr/lib/libmen.oo/.LJK2/backup/locate",
				"/usr/lib/libmen.oo/.LJK2/backup/login",
				"/usr/lib/libmen.oo/.LJK2/backup/ls",
				"/usr/lib/libmen.oo/.LJK2/backup/netstat",
				"/usr/lib/libmen.oo/.LJK2/backup/ps",
				"/usr/lib/libmen.oo/.LJK2/backup/pstree",
				"/usr/lib/libmen.oo/.LJK2/backup/rc.sysinit",
				"/usr/lib/libmen.oo/.LJK2/backup/syslogd",
				"/usr/lib/libmen.oo/.LJK2/backup/tcpd",
				"/usr/lib/libmen.oo/.LJK2/backup/top",
				"/usr/lib/libmen.oo/.LJK2/clean/RK1sauber",
				"/usr/lib/libmen.oo/.LJK2/clean/RK1wted",
				"/usr/lib/libmen.oo/.LJK2/hack/RK1parse",
				"/usr/lib/libmen.oo/.LJK2/hack/RK1sniff",
				"/usr/lib/libmen.oo/.LJK2/hide/.RK1addr",
				"/usr/lib/libmen.oo/.LJK2/hide/.RK1dir",
				"/usr/lib/libmen.oo/.LJK2/hide/.RK1log",
				"/usr/lib/libmen.oo/.LJK2/hide/.RK1proc",
				"/usr/lib/libmen.oo/.LJK2/hide/RK1phidemod.c",
				"/usr/lib/libmen.oo/.LJK2/modules/README.modules",
				"/usr/lib/libmen.oo/.LJK2/modules/RK1hidem.c",
				"/usr/lib/libmen.oo/.LJK2/modules/RK1phide",
				"/usr/lib/libmen.oo/.LJK2/sshconfig/RK1ssh",
			},
			Dir: []string{
				"/usr/lib/libmen.oo/.LJK2",
			},
			Ksyms: []string{},
		},
		{
			Name: "Mokes backdoor",
			File: []string{
				"/tmp/ss0-[0-9][0-9][0-9][0-9][0-9][0-9]-[0-9][0-9][0-9][0-9][0-9][0-9]-[0-9][0-9][0-9].sst",
				"/tmp/aa0-[0-9][0-9][0-9][0-9][0-9][0-9]-[0-9][0-9][0-9][0-9][0-9][0-9]-[0-9][0-9][0-9].aat",
				"/tmp/kk0-[0-9][0-9][0-9][0-9][0-9][0-9]-[0-9][0-9][0-9][0-9][0-9][0-9]-[0-9][0-9][0-9].kkt",
				"/tmp/dd0-[0-9][0-9][0-9][0-9][0-9][0-9]-[0-9][0-9][0-9][0-9][0-9][0-9]-[0-9][0-9][0-9].ddt",
			},
			Dir:   []string{},
			Ksyms: []string{},
		},
		{
			Name: "MRK RootKit",
			File: []string{
				"/dev/ida/.inet/pid",
				"/dev/ida/.inet/ssh_host_key",
				"/dev/ida/.inet/ssh_random_seed",
				"/dev/ida/.inet/tcp.log",
			},
			Dir: []string{
				"/dev/ida/.inet",
				"/var/spool/cron/.sh",
			},
			Ksyms: []string{},
		},
		{
			Name: "Mood-NT Rootkit",
			File: []string{
				"/sbin/init__mood-nt-_-_cthulhu",
				"/_cthulhu/mood-nt.init",
				"/_cthulhu/mood-nt.conf",
				"/_cthulhu/mood-nt.sniff",
			},
			Dir: []string{
				"/_cthulhu",
			},
			Ksyms: []string{},
		},
		{
			Name: "Ni0 Rootkit",
			File: []string{
				"/var/lock/subsys/...datafile.../...net...",
				"/var/lock/subsys/...datafile.../...port...",
				"/var/lock/subsys/...datafile.../...ps...",
				"/var/lock/subsys/...datafile.../...file...",
			},
			Dir: []string{
				"/tmp/waza",
				"/var/lock/subsys/...datafile...",
				"/usr/sbin/es",
			},
			Ksyms: []string{},
		},
		{
			Name: "Ohhara Rootkit",
			File: []string{
				"/var/lock/subsys/...datafile.../...datafile.../in.smbd.log",
			},
			Dir: []string{
				"/var/lock/subsys/...datafile...",
				"/var/lock/subsys/...datafile.../...datafile...",
				"/var/lock/subsys/...datafile.../...datafile.../bin",
				"/var/lock/subsys/...datafile.../...datafile.../usr/bin",
				"/var/lock/subsys/...datafile.../...datafile.../usr/sbin",
				"/var/lock/subsys/...datafile.../...datafile.../lib/security",
			},
			Ksyms: []string{},
		},
		{
			Name: "Optic Kit Rootkit",
			File: []string{},
			Dir: []string{
				"/dev/tux",
				"/usr/bin/xchk",
				"/usr/bin/xsf",
				"/usr/bin/ssh2d",
			},
			Ksyms: []string{},
		},
		{
			Name: "OSXRK",
			File: []string{
				"/dev/.rk/nc",
				"/dev/.rk/diepu",
				"/dev/.rk/backd",
				"/Library/StartupItems/opener",
				"/Library/StartupItems/opener.sh",
				"/System/Library/StartupItems/opener",
				"/System/Library/StartupItems/opener.sh",
			},
			Dir: []string{
				"/dev/.rk",
				"/Users/LDAP-daemon",
				"/tmp/.work",
			},
			Ksyms: []string{},
		},
		{
			Name: "Oz Rootkit",
			File: []string{
				"/dev/.oz/.nap/rkit/terror",
			},
			Dir: []string{
				"/dev/.oz",
			},
			Ksyms: []string{},
		},
		{
			Name: "Phalanx Rootkit",
			File: []string{
				"/uNFuNF",
				"/etc/host.ph1",
				"/bin/host.ph1",
				"/usr/share/.home.ph1/phalanx",
				"/usr/share/.home.ph1/cb",
				"/usr/share/.home.ph1/kebab",
			},
			Dir: []string{
				"/usr/share/.home.ph1",
				"/usr/share/.home.ph1/tty",
			},
			Ksyms: []string{},
		},
		{
			Name: "Phalanx2 Rootkit",
			File: []string{
				"/etc/khubd.p2/.p2rc",
				"/etc/khubd.p2/.phalanx2",
				"/etc/khubd.p2/.sniff",
				"/etc/khubd.p2/sshgrab.py",
				"/etc/lolzz.p2/.p2rc",
				"/etc/lolzz.p2/.phalanx2",
				"/etc/lolzz.p2/.sniff",
				"/etc/lolzz.p2/sshgrab.py",
				"/etc/cron.d/zupzzplaceholder",
				"/usr/lib/zupzz.p2/.p-2.3d",
				"/usr/lib/zupzz.p2/.p2rc",
			},
			Dir: []string{
				"/etc/khubd.p2",
				"/etc/lolzz.p2",
				"/usr/lib/zupzz.p2",
			},
			Ksyms: []string{},
		},
		{
			Name: "Portacelo Rootkit",
			File: []string{
				"/var/lib/.../.ak",
				"/var/lib/.../.hk",
				"/var/lib/.../.rs",
				"/var/lib/.../.p",
				"/var/lib/.../getty",
				"/var/lib/.../lkt.o",
				"/var/lib/.../show",
				"/var/lib/.../nlkt.o",
				"/var/lib/.../ssshrc",
				"/var/lib/.../sssh_equiv",
				"/var/lib/.../sssh_known_hosts",
				"/var/lib/.../sssh_pid ~/.sssh/known_hosts",
			},
			Dir:   []string{},
			Ksyms: []string{},
		},
		{
			Name: "OSX Proton backdoor",
			File: []string{
				"Library/LaunchAgents/com.apple.xpcd.plist",
				"/Library/LaunchAgents/com.Eltima.UpdaterAgent.plist",
				"/Library/.rand/updateragent.app",
				"/tmp/Updater.app",
			},
			Dir: []string{
				"/Library/.rand",
				"/Library/.cachedir",
				"/Library/.random",
			},
			Ksyms: []string{},
		},
		{
			Name: "R3dstorm Toolkit",
			File: []string{
				"/var/log/tk02/see_all",
				"/var/log/tk02/.scris",
				"/bin/.../sshd/sbin/sshd1",
				"/bin/.../hate/sk",
				"/bin/.../see_all",
			},
			Dir: []string{
				"/var/log/tk02",
				"/var/log/tk02/old",
				"/bin/...",
			},
			Ksyms: []string{},
		},
		{
			Name: "RH-Sharpe Rootkit",
			File: []string{
				"/bin/lps",
				"/usr/bin/lpstree",
				"/usr/bin/ltop",
				"/usr/bin/lkillall",
				"/usr/bin/ldu",
				"/usr/bin/lnetstat",
				"/usr/bin/wp",
				"/usr/bin/shad",
				"/usr/bin/vadim",
				"/usr/bin/slice",
				"/usr/bin/cleaner",
				"/usr/include/rpcsvc/du",
			},
			Dir:   []string{},
			Ksyms: []string{},
		},
		{
			Name: "RSHA Rootkit",
			File: []string{
				"/bin/kr4p",
				"/usr/bin/n3tstat",
				"/usr/bin/chsh2",
				"/usr/bin/slice2",
				"/usr/src/linux/arch/alpha/lib/.lib/.1proc",
				"/etc/rc.d/arch/alpha/lib/.lib/.1addr",
			},
			Dir: []string{
				"/etc/rc.d/rsha",
				"/etc/rc.d/arch/alpha/lib/.lib",
			},
			Ksyms: []string{},
		},
		{
			Name: "Shutdown Rootkit",
			File: []string{
				"/usr/man/man5/..%/.dir/scannah/asus",
				"/usr/man/man5/..%/.dir/see",
				"/usr/man/man5/..%/.dir/nscd",
				"/usr/man/man5/..%/.dir/alpd",
				"/etc/rc.d/rc.local%",
			},
			Dir: []string{
				"/usr/man/man5/..%/.dir",
				"/usr/man/man5/..%/.dir/scannah",
				"/etc/rc.d/rc0.d/..%/.dir",
			},
			Ksyms: []string{},
		},
		{
			Name: "Scalper Worm",
			File: []string{
				"/tmp/.a",
				"/tmp/.uua",
			},
			Dir:   []string{},
			Ksyms: []string{},
		},
		{
			Name: "SHV4 Rootkit",
			File: []string{
				"/etc/ld.so.hash",
				"/lib/libext-2.so.7",
				"/lib/lidps1.so",
				"/lib/libproc.a",
				"/lib/libproc.so.2.0.6",
				"/lib/ldd.so/tks",
				"/lib/ldd.so/tkp",
				"/lib/ldd.so/tksb",
				"/lib/security/.config/sshd",
				"/lib/security/.config/ssh/ssh_host_key",
				"/lib/security/.config/ssh/ssh_host_key.pub",
				"/lib/security/.config/ssh/ssh_random_seed",
				"/usr/include/file.h",
				"/usr/include/hosts.h",
				"/usr/include/lidps1.so",
				"/usr/include/log.h",
				"/usr/include/proc.h",
				"/usr/sbin/xntps",
				"/dev/srd0",
			},
			Dir: []string{
				"/lib/ldd.so",
				"/lib/security/.config",
				"/lib/security/.config/ssh",
			},
			Ksyms: []string{},
		},
		{
			Name: "SHV5 Rootkit",
			File: []string{
				"/etc/sh.conf",
				"/lib/libproc.a",
				"/lib/libproc.so.2.0.6",
				"/lib/lidps1.so",
				"/lib/libsh.so/bash",
				"/usr/include/file.h",
				"/usr/include/hosts.h",
				"/usr/include/log.h",
				"/usr/include/proc.h",
				"/lib/libsh.so/shdcf2",
				"/lib/libsh.so/shhk",
				"/lib/libsh.so/shhk.pub",
				"/lib/libsh.so/shrs",
				"/usr/lib/libsh/.bashrc",
				"/usr/lib/libsh/shsb",
				"/usr/lib/libsh/hide",
				"/usr/lib/libsh/.sniff/shsniff",
				"/usr/lib/libsh/.sniff/shp",
				"/dev/srd0",
			},
			Dir: []string{
				"/lib/libsh.so",
				"/usr/lib/libsh",
				"/usr/lib/libsh/utilz",
				"/usr/lib/libsh/.backup",
			},
			Ksyms: []string{},
		},
		{
			Name: "Sin Rootkit",
			File: []string{
				"/dev/.haos/haos1/.f/Denyed",
				"/dev/ttyoa",
				"/dev/ttyof",
				"/dev/ttyop",
				"/dev/ttyos",
				"/usr/lib/.lib",
				"/usr/lib/sn/.X",
				"/usr/lib/sn/.sys",
				"/usr/lib/ld/.X",
				"/usr/man/man1/...",
				"/usr/man/man1/.../.m",
				"/usr/man/man1/.../.w",
			},
			Dir: []string{
				"/usr/lib/sn",
				"/usr/lib/man1/...",
				"/dev/.haos",
			},
			Ksyms: []string{},
		},
		{
			Name: "Slapper Worm",
			File: []string{
				"/tmp/.bugtraq",
				"/tmp/.uubugtraq",
				"/tmp/.bugtraq.c",
				"/tmp/httpd",
				"/tmp/.unlock",
				"/tmp/update",
				"/tmp/.cinik",
				"/tmp/.b",
			},
			Dir:   []string{},
			Ksyms: []string{},
		},
		{
			Name: "Sneakin Rootkit",
			File: []string{},
			Dir: []string{
				"/tmp/.X11-unix/.../rk",
			},
			Ksyms: []string{},
		},
		{
			Name: "Solaris Wanuk backdoor",
			File: []string{
				"/var/adm/sa/.adm/.lp-door.i86pc",
				"/var/adm/sa/.adm/.lp-door.sun4",
				"/var/spool/lp/admins/.lp-door.i86pc",
				"/var/spool/lp/admins/.lp-door.sun4",
				"/var/spool/lp/admins/lpshut",
				"/var/spool/lp/admins/lpsystem",
				"/var/spool/lp/admins/lpadmin",
				"/var/spool/lp/admins/lpmove",
				"/var/spool/lp/admins/lpusers",
				"/var/spool/lp/admins/lpfilter",
				"/var/spool/lp/admins/lpstat",
				"/var/spool/lp/admins/lpd",
				"/var/spool/lp/admins/lpsched",
				"/var/spool/lp/admins/lpc",
			},
			Dir: []string{
				"/var/adm/sa/.adm",
			},
			Ksyms: []string{},
		},
		{
			Name: "Solaris Wanuk Worm",
			File: []string{
				"/var/adm/.adm",
				"/var/adm/.i86pc",
				"/var/adm/.sun4",
				"/var/adm/sa/.adm",
				"/var/adm/sa/.adm/.i86pc",
				"/var/adm/sa/.adm/.sun4",
				"/var/adm/sa/.adm/.crontab",
				"/var/adm/sa/.adm/devfsadmd",
				"/var/adm/sa/.adm/svcadm",
				"/var/adm/sa/.adm/cfgadm",
				"/var/adm/sa/.adm/kadmind",
				"/var/adm/sa/.adm/zoneadmd",
				"/var/adm/sa/.adm/sadm",
				"/var/adm/sa/.adm/sysadm",
				"/var/adm/sa/.adm/dladm",
				"/var/adm/sa/.adm/bootadm",
				"/var/adm/sa/.adm/routeadm",
				"/var/adm/sa/.adm/uadmin",
				"/var/adm/sa/.adm/acctadm",
				"/var/adm/sa/.adm/cryptoadm",
				"/var/adm/sa/.adm/inetadm",
				"/var/adm/sa/.adm/logadm",
				"/var/adm/sa/.adm/nlsadmin",
				"/var/adm/sa/.adm/sacadm",
				"/var/adm/sa/.adm/syseventadmd",
				"/var/adm/sa/.adm/ttyadmd",
				"/var/adm/sa/.adm/consadmd",
				"/var/adm/sa/.adm/metadevadm",
				"/var/adm/sa/.i86pc",
				"/var/adm/sa/.sun4",
				"/var/adm/sa/acctadm",
				"/var/adm/sa/bootadm",
				"/var/adm/sa/cfgadm",
				"/var/adm/sa/consadmd",
				"/var/adm/sa/cryptoadm",
				"/var/adm/sa/devfsadmd",
				"/var/adm/sa/dladm",
				"/var/adm/sa/inetadm",
				"/var/adm/sa/kadmind",
				"/var/adm/sa/logadm",
				"/var/adm/sa/metadevadm",
				"/var/adm/sa/nlsadmin",
				"/var/adm/sa/routeadm",
				"/var/adm/sa/sacadm",
				"/var/adm/sa/sadm",
				"/var/adm/sa/svcadm",
				"/var/adm/sa/sysadm",
				"/var/adm/sa/syseventadmd",
				"/var/adm/sa/ttyadmd",
				"/var/adm/sa/uadmin",
				"/var/adm/sa/zoneadmd",
				"/var/spool/lp/admins/.lp/.crontab",
				"/var/spool/lp/admins/.lp/lpshut",
				"/var/spool/lp/admins/.lp/lpsystem",
				"/var/spool/lp/admins/.lp/lpadmin",
				"/var/spool/lp/admins/.lp/lpmove",
				"/var/spool/lp/admins/.lp/lpusers",
				"/var/spool/lp/admins/.lp/lpfilter",
				"/var/spool/lp/admins/.lp/lpstat",
				"/var/spool/lp/admins/.lp/lpd",
				"/var/spool/lp/admins/.lp/lpsched",
				"/var/spool/lp/admins/.lp/lpc",
			},
			Dir: []string{
				"/var/adm/sa/.adm",
				"/var/spool/lp/admins/.lp",
			},
			Ksyms: []string{},
		},
		{
			Name: "Spanish Rootkit",
			File: []string{
				"/dev/ptyq",
				"/bin/ad",
				"/bin/ava",
				"/bin/server",
				"/usr/sbin/rescue",
				"/usr/share/.../chrps",
				"/usr/share/.../chrifconfig",
				"/usr/share/.../netstat",
				"/usr/share/.../linsniffer",
				"/usr/share/.../charbd",
				"/usr/share/.../charbd2",
				"/usr/share/.../charbd3",
				"/usr/share/.../charbd4",
				"/usr/man/tmp/update.tgz",
				"/var/lib/rpm/db.rpm",
				"/var/cache/man/.cat",
				"/var/spool/lpd/remote/.lpq",
			},
			Dir: []string{
				"/usr/share/...",
			},
			Ksyms: []string{},
		},
		{
			Name: "Suckit Rootkit",
			File: []string{
				"/sbin/initsk12",
				"/sbin/initxrk",
				"/usr/bin/null",
				"/usr/share/locale/sk/.sk12/sk",
				"/etc/rc.d/rc0.d/S23kmdac",
				"/etc/rc.d/rc1.d/S23kmdac",
				"/etc/rc.d/rc2.d/S23kmdac",
				"/etc/rc.d/rc3.d/S23kmdac",
				"/etc/rc.d/rc4.d/S23kmdac",
				"/etc/rc.d/rc5.d/S23kmdac",
				"/etc/rc.d/rc6.d/S23kmdac",
			},
			Dir: []string{
				"/dev/sdhu0/tehdrakg",
				"/etc/.MG",
				"/usr/share/locale/sk/.sk12",
				"/usr/lib/perl5/site_perl/i386-linux/auto/TimeDate/.packlist",
			},
			Ksyms: []string{},
		},
		{
			Name: "NSDAP Rootkit",
			File: []string{
				"/dev/pts/01/55su",
				"/dev/pts/01/55ps",
				"/dev/pts/01/55ping",
				"/dev/pts/01/55login",
				"/dev/pts/01/PATCHER_COMPLETED",
				"/dev/prom/sn.l",
				"/dev/prom/dos",
				"/usr/lib/vold/nsdap/.kit",
				"/usr/lib/vold/nsdap/defines",
				"/usr/lib/vold/nsdap/patcher",
				"/usr/lib/vold/nsdap/pg",
				"/usr/lib/vold/nsdap/cleaner",
				"/usr/lib/vold/nsdap/utime",
				"/usr/lib/vold/nsdap/crypt",
				"/usr/lib/vold/nsdap/findkit",
				"/usr/lib/vold/nsdap/sn2",
				"/usr/lib/vold/nsdap/sniffload",
				"/usr/lib/vold/nsdap/runsniff",
				"/usr/lib/lpset",
				"/usr/lib/lpstart",
				"/usr/bin/mc68000",
				"/usr/bin/mc68010",
				"/usr/bin/mc68020",
				"/usr/ucb/bin/ps",
				"/usr/bin/m68k",
				"/usr/bin/sun2",
				"/usr/bin/mc68030",
				"/usr/bin/mc68040",
				"/usr/bin/sun3",
				"/usr/bin/sun3x",
				"/usr/bin/lso",
				"/usr/bin/u370",
			},
			Dir: []string{
				"/dev/pts/01",
				"/dev/prom",
				"/usr/lib/vold/nsdap",
				"/.pat",
			},
			Ksyms: []string{},
		},
		{
			Name: "SunOS Rootkit",
			File: []string{
				"/etc/ld.so.hash",
				"/lib/libext-2.so.7",
				"/usr/bin/ssh2d",
				"/bin/xlogin",
				"/usr/lib/crth.o",
				"/usr/lib/crtz.o",
				"/sbin/login",
				"/lib/security/.config/sn",
				"/lib/security/.config/lpsched",
				"/dev/kmod",
				"/dev/dos",
			},
			Dir:   []string{},
			Ksyms: []string{},
		},
		{
			Name: "Superkit Rootkit",
			File: []string{
				"/usr/man/.sman/sk/backsh",
				"/usr/man/.sman/sk/izbtrag",
				"/usr/man/.sman/sk/sksniff",
				"/var/www/cgi-bin/cgiback.cgi",
			},
			Dir: []string{
				"/usr/man/.sman/sk",
			},
			Ksyms: []string{},
		},
		{
			Name: "TBD(Telnet Backdoor)",
			File: []string{
				"/usr/lib/.tbd",
			},
			Dir:   []string{},
			Ksyms: []string{},
		},
		{
			Name: "TeLeKiT Rootkit",
			File: []string{
				"/usr/man/man3/.../TeLeKiT/bin/sniff",
				"/usr/man/man3/.../TeLeKiT/bin/telnetd",
				"/usr/man/man3/.../TeLeKiT/bin/teleulo",
				"/usr/man/man3/.../cl",
				"/dev/ptyr",
				"/dev/ptyp",
				"/dev/ptyq",
				"/dev/hda06",
				"/usr/info/libc1.so",
			},
			Dir: []string{
				"/usr/man/man3/...",
				"/usr/man/man3/.../lsniff",
				"/usr/man/man3/.../TeLeKiT",
			},
			Ksyms: []string{},
		},
		{
			Name: "OSX Togroot Rootkit",
			File: []string{
				"/System/Library/Extensions/Togroot.kext/Contents/Info.plist",
				"/System/Library/Extensions/Togroot.kext/Contents/pbdevelopment.plist",
				"/System/Library/Extensions/Togroot.kext/Contents/MacOS/togrootkext",
			},
			Dir: []string{
				"/System/Library/Extensions/Togroot.kext",
				"/System/Library/Extensions/Togroot.kext/Contents",
				"/System/Library/Extensions/Togroot.kext/Contents/MacOS",
			},
			Ksyms: []string{},
		},
		{
			Name: "T0rn Rootkit",
			File: []string{
				"/dev/.lib/lib/lib/t0rns",
				"/dev/.lib/lib/lib/du",
				"/dev/.lib/lib/lib/ls",
				"/dev/.lib/lib/lib/t0rnsb",
				"/dev/.lib/lib/lib/ps",
				"/dev/.lib/lib/lib/t0rnp",
				"/dev/.lib/lib/lib/find",
				"/dev/.lib/lib/lib/ifconfig",
				"/dev/.lib/lib/lib/pg",
				"/dev/.lib/lib/lib/ssh.tgz",
				"/dev/.lib/lib/lib/top",
				"/dev/.lib/lib/lib/sz",
				"/dev/.lib/lib/lib/login",
				"/dev/.lib/lib/lib/in.fingerd",
				"/dev/.lib/lib/lib/1i0n.sh",
				"/dev/.lib/lib/lib/pstree",
				"/dev/.lib/lib/lib/in.telnetd",
				"/dev/.lib/lib/lib/mjy",
				"/dev/.lib/lib/lib/sush",
				"/dev/.lib/lib/lib/tfn",
				"/dev/.lib/lib/lib/name",
				"/dev/.lib/lib/lib/getip.sh",
				"/usr/info/.torn/sh*",
				"/usr/src/.puta/.1addr",
				"/usr/src/.puta/.1file",
				"/usr/src/.puta/.1proc",
				"/usr/src/.puta/.1logz",
				"/usr/info/.t0rn",
			},
			Dir: []string{
				"/dev/.lib",
				"/dev/.lib/lib",
				"/dev/.lib/lib/lib",
				"/dev/.lib/lib/lib/dev",
				"/dev/.lib/lib/scan",
				"/usr/src/.puta",
				"/usr/man/man1/man1",
				"/usr/man/man1/man1/lib",
				"/usr/man/man1/man1/lib/.lib",
				"/usr/man/man1/man1/lib/.lib/.backup",
			},
			Ksyms: []string{},
		},
		{
			Name: "trNkit Rootkit",
			File: []string{
				"/usr/lib/libbins.la",
				"/usr/lib/libtcs.so",
				"/dev/.ttpy/ulogin.sh",
				"/dev/.ttpy/tcpshell.sh",
				"/dev/.ttpy/bupdu",
				"/dev/.ttpy/buloc",
				"/dev/.ttpy/buloc1",
				"/dev/.ttpy/buloc2",
				"/dev/.ttpy/stat",
				"/dev/.ttpy/backps",
				"/dev/.ttpy/tree",
				"/dev/.ttpy/topk",
				"/dev/.ttpy/wold",
				"/dev/.ttpy/whoold",
				"/dev/.ttpy/backdoors",
			},
			Dir:   []string{},
			Ksyms: []string{},
		},
		{
			Name: "Trojanit Kit Rootkit",
			File: []string{
				"bin/.ls",
				"/bin/.ps",
				"/bin/.netstat",
				"/usr/bin/.nop",
				"/usr/bin/.who",
			},
			Dir:   []string{},
			Ksyms: []string{},
		},
		{
			Name: "Turtle Rootkit",
			File: []string{
				"/dev/turtle2dev",
			},
			Dir:   []string{},
			Ksyms: []string{},
		},
		{
			Name: "Tuxtendo Rootkit",
			File: []string{
				"/lib/libproc.so.2.0.7",
				"/usr/bin/xchk",
				"/usr/bin/xsf",
				"/dev/tux/suidsh",
				"/dev/tux/.addr",
				"/dev/tux/.cron",
				"/dev/tux/.file",
				"/dev/tux/.log",
				"/dev/tux/.proc",
				"/dev/tux/.iface",
				"/dev/tux/.pw",
				"/dev/tux/.df",
				"/dev/tux/.ssh",
				"/dev/tux/.tux",
				"/dev/tux/ssh2/sshd2_config",
				"/dev/tux/ssh2/hostkey",
				"/dev/tux/ssh2/hostkey.pub",
				"/dev/tux/ssh2/logo",
				"/dev/tux/ssh2/random_seed",
				"/dev/tux/backup/crontab",
				"/dev/tux/backup/df",
				"/dev/tux/backup/dir",
				"/dev/tux/backup/find",
				"/dev/tux/backup/ifconfig",
				"/dev/tux/backup/locate",
				"/dev/tux/backup/netstat",
				"/dev/tux/backup/ps",
				"/dev/tux/backup/pstree",
				"/dev/tux/backup/syslogd",
				"/dev/tux/backup/tcpd",
				"/dev/tux/backup/top",
				"/dev/tux/backup/updatedb",
				"/dev/tux/backup/vdir",
			},
			Dir: []string{
				"/dev/tux",
				"/dev/tux/ssh2",
				"/dev/tux/backup",
			},
			Ksyms: []string{},
		},
		{
			Name: "Universal Rootkit",
			File: []string{
				"/dev/prom/sn.l",
				"/usr/lib/ldlibps.so",
				"/usr/lib/ldlibnet.so",
				"/dev/pts/01/uconf.inv",
				"/dev/pts/01/cleaner",
				"/dev/pts/01/bin/psniff",
				"/dev/pts/01/bin/du",
				"/dev/pts/01/bin/ls",
				"/dev/pts/01/bin/passwd",
				"/dev/pts/01/bin/ps",
				"/dev/pts/01/bin/psr",
				"/dev/pts/01/bin/su",
				"/dev/pts/01/bin/find",
				"/dev/pts/01/bin/netstat",
				"/dev/pts/01/bin/ping",
				"/dev/pts/01/bin/strings",
				"/dev/pts/01/bin/bash",
				"/usr/man/man1/xxxxxxbin/du",
				"/usr/man/man1/xxxxxxbin/ls",
				"/usr/man/man1/xxxxxxbin/passwd",
				"/usr/man/man1/xxxxxxbin/ps",
				"/usr/man/man1/xxxxxxbin/psr",
				"/usr/man/man1/xxxxxxbin/su",
				"/usr/man/man1/xxxxxxbin/find",
				"/usr/man/man1/xxxxxxbin/netstat",
				"/usr/man/man1/xxxxxxbin/ping",
				"/usr/man/man1/xxxxxxbin/strings",
				"/usr/man/man1/xxxxxxbin/bash",
				"/tmp/conf.inv",
			},
			Dir: []string{
				"/dev/prom",
				"/dev/pts/01",
				"/dev/pts/01/bin",
				"/usr/man/man1/xxxxxxbin",
			},
			Ksyms: []string{},
		},
		{
			Name: "VcKit Rootkit",
			File: []string{},
			Dir: []string{
				"/usr/include/linux/modules/lib.so",
				"/usr/include/linux/modules/lib.so/bin",
			},
			Ksyms: []string{},
		},
		{
			Name: "Vampire Rootkit",
			File: []string{},
			Dir:  []string{},
			Ksyms: []string{
				"new_getdents",
				"old_getdents",
				"should_hide_file_name",
				"should_hide_task_name",
			},
		},
		{
			Name: "Volc Rootkit",
			File: []string{
				"/usr/bin/volc",
				"/usr/lib/volc/backdoor/divine",
				"/usr/lib/volc/linsniff",
				"/etc/rc.d/rc1.d/S25sysconf",
				"/etc/rc.d/rc2.d/S25sysconf",
				"/etc/rc.d/rc3.d/S25sysconf",
				"/etc/rc.d/rc4.d/S25sysconf",
				"/etc/rc.d/rc5.d/S25sysconf",
			},
			Dir: []string{
				"/var/spool/.recent",
				"/var/spool/.recent/.files",
				"/usr/lib/volc",
				"/usr/lib/volc/backup",
			},
			Ksyms: []string{},
		},
		{
			Name: "weaponX",
			File: []string{
				"/System/Library/Extensions/WeaponX.kext",
			},
			Dir: []string{
				"/tmp/...",
			},
			Ksyms: []string{},
		},
		{
			Name: "Xzibit Rootkit",
			File: []string{
				"/dev/dsx",
				"/dev/caca",
				"/dev/ida/.inet/linsniffer",
				"/dev/ida/.inet/logclear",
				"/dev/ida/.inet/sense",
				"/dev/ida/.inet/sl2",
				"/dev/ida/.inet/sshdu",
				"/dev/ida/.inet/s",
				"/dev/ida/.inet/ssh_host_key",
				"/dev/ida/.inet/ssh_random_seed",
				"/dev/ida/.inet/sl2new.c",
				"/dev/ida/.inet/tcp.log",
				"/home/httpd/cgi-bin/becys.cgi",
				"/usr/local/httpd/cgi-bin/becys.cgi",
				"/usr/local/apache/cgi-bin/becys.cgi",
				"/www/httpd/cgi-bin/becys.cgi",
				"/www/cgi-bin/becys.cgi",
			},
			Dir: []string{
				"/dev/ida/.inet",
			},
			Ksyms: []string{},
		},
		{
			Name: "X-Org SunOS Rootkit",
			File: []string{
				"/usr/lib/libX.a/bin/tmpfl",
				"/usr/lib/libX.a/bin/rps",
				"/usr/bin/srload",
				"/usr/lib/libX.a/bin/sparcv7/rps",
				"/usr/sbin/modcheck",
			},
			Dir: []string{
				"/usr/lib/libX.a",
				"/usr/lib/libX.a/bin",
				"/usr/lib/libX.a/bin/sparcv7",
				"/usr/share/man...",
			},
			Ksyms: []string{},
		},
		{
			Name: "zaRwT.KiT Rootkit",
			File: []string{
				"/dev/rd/s/sendmeil",
				"/dev/ttyf",
				"/dev/ttyp",
				"/dev/ttyn",
				"/rk/tulz",
			},
			Dir: []string{
				"/rk",
				"/dev/rd/s",
			},
			Ksyms: []string{},
		},
		{
			Name: "ZK Rootkit",
			File: []string{
				"/usr/share/.zk/zk",
				"/usr/X11R6/.zk/xfs",
				"/usr/X11R6/.zk/echo",
				"/etc/1ssue.net",
				"/etc/sysconfig/console/load.zk",
			},
			Dir: []string{
				"/usr/share/.zk",
				"/usr/X11R6/.zk",
			},
			Ksyms: []string{},
		},
		{
			Name: "Miscellaneous login backdoors",
			File: []string{
				"/bin/.login",
				"/sbin/.login",
			},
			Dir:   []string{},
			Ksyms: []string{},
		},
		{
			Name: "Sniffer log",
			File: []string{
				"/usr/lib/libice.log",
				"/dev/prom/sn.l",
				"/dev/fd/.88/zxsniff.log",
			},
			Dir:   []string{},
			Ksyms: []string{},
		},
		{
			Name: "Suspicious dir",
			File: []string{},
			Dir: []string{
				"/usr/X11R6/bin/.,/copy",
				"/dev/rd/cdb",
			},
			Ksyms: []string{},
		},
		{
			Name: "Apache backdoor",
			File: []string{
				"/etc/apache2/mods-enabled/mod_rootme.so",
				"/etc/apache2/mods-enabled/mod_rootme2.so",
				"/etc/httpd/modules/mod_rootme.so",
				"/etc/httpd/modules/mod_rootme2.so",
				"/usr/apache/libexec/mod_rootme.so",
				"/usr/apache/libexec/mod_rootme2.so",
				"/usr/lib/modules/mod_rootme.so",
				"/usr/lib/modules/mod_rootme2.so",
				"/usr/local/apache/modules/mod_rootme.so",
				"/usr/local/apache/modules/mod_rootme2.so",
				"/usr/local/apache/conf/mod_rootme.so",
				"/usr/local/apache/conf/mod_rootme2.so",
				"/usr/local/etc/apache/mod_rootme.so",
				"/usr/local/etc/apache/mod_rootme2.so",
				"/etc/apache/mod_rootme.so",
				"/etc/apache/mod_rootme2.so",
				"/etc/httpd/conf/mod_rootme.so",
				"/etc/httpd/conf/mod_rootme2.so",
			},
			Dir:   []string{},
			Ksyms: []string{},
		},
	}

	KcallList = []*SyscallEntry{
		{Name: "sys_read"},
		{Name: "sys_write"},
		{Name: "sys_open"},
		{Name: "sys_close"},
		{Name: "sys_stat"},
		{Name: "sys_fstat"},
		{Name: "sys_lstat"},
		{Name: "sys_poll"},
		{Name: "sys_lseek"},
		{Name: "sys_mmap"},
		{Name: "sys_mprotect"},
		{Name: "sys_munmap"},
		{Name: "sys_brk"},
		{Name: "sys_rt_sigaction"},
		{Name: "sys_rt_sigprocmask"},
		{Name: "sys_rt_sigreturn"},
		{Name: "sys_ioctl"},
		{Name: "sys_pread64"},
		{Name: "sys_pwrite64"},
		{Name: "sys_readv"},
		{Name: "sys_writev"},
		{Name: "sys_access"},
		{Name: "sys_pipe"},
		{Name: "sys_select"},
		{Name: "sys_sched_yield"},
		{Name: "sys_mremap"},
		{Name: "sys_msync"},
		{Name: "sys_mincore"},
		{Name: "sys_madvise"},
		{Name: "sys_shmget"},
		{Name: "sys_shmat"},
		{Name: "sys_shmctl"},
		{Name: "sys_dup"},
		{Name: "sys_dup2"},
		{Name: "sys_pause"},
		{Name: "sys_nanosleep"},
		{Name: "sys_getitimer"},
		{Name: "sys_alarm"},
		{Name: "sys_setitimer"},
		{Name: "sys_getpid"},
		{Name: "sys_sendfile"},
		{Name: "sys_socket"},
		{Name: "sys_connect"},
		{Name: "sys_accept"},
		{Name: "sys_sendto"},
		{Name: "sys_recvfrom"},
		{Name: "sys_sendmsg"},
		{Name: "sys_recvmsg"},
		{Name: "sys_shutdown"},
		{Name: "sys_bind"},
		{Name: "sys_listen"},
		{Name: "sys_getsockname"},
		{Name: "sys_getpeername"},
		{Name: "sys_socketpair"},
		{Name: "sys_setsockopt"},
		{Name: "sys_getsockopt"},
		{Name: "sys_clone"},
		{Name: "sys_fork"},
		{Name: "sys_vfork"},
		{Name: "sys_execve"},
		{Name: "sys_exit"},
		{Name: "sys_wait4"},
		{Name: "sys_kill"},
		{Name: "sys_uname"},
		{Name: "sys_semget"},
		{Name: "sys_semop"},
		{Name: "sys_semctl"},
		{Name: "sys_shmdt"},
		{Name: "sys_msgget"},
		{Name: "sys_msgsnd"},
		{Name: "sys_msgrcv"},
		{Name: "sys_msgctl"},
		{Name: "sys_fcntl"},
		{Name: "sys_flock"},
		{Name: "sys_fsync"},
		{Name: "sys_fdatasync"},
		{Name: "sys_truncate"},
		{Name: "sys_ftruncate"},
		{Name: "sys_getdents"},
		{Name: "sys_getcwd"},
		{Name: "sys_chdir"},
		{Name: "sys_fchdir"},
		{Name: "sys_rename"},
		{Name: "sys_mkdir"},
		{Name: "sys_rmdir"},
		{Name: "sys_creat"},
		{Name: "sys_link"},
		{Name: "sys_unlink"},
		{Name: "sys_symlink"},
		{Name: "sys_readlink"},
		{Name: "sys_chmod"},
		{Name: "sys_fchmod"},
		{Name: "sys_chown"},
		{Name: "sys_fchown"},
		{Name: "sys_lchown"},
		{Name: "sys_umask"},
		{Name: "sys_gettimeofday"},
		{Name: "sys_getrlimit"},
		{Name: "sys_getrusage"},
		{Name: "sys_sysinfo"},
		{Name: "sys_times"},
		{Name: "sys_ptrace"},
		{Name: "sys_getuid"},
		{Name: "sys_syslog"},
		{Name: "sys_getgid"},
		{Name: "sys_setuid"},
		{Name: "sys_setgid"},
		{Name: "sys_geteuid"},
		{Name: "sys_getegid"},
		{Name: "sys_setpgid"},
		{Name: "sys_getppid"},
		{Name: "sys_getpgrp"},
		{Name: "sys_setsid"},
		{Name: "sys_setreuid"},
		{Name: "sys_setregid"},
		{Name: "sys_getgroups"},
		{Name: "sys_setgroups"},
		{Name: "sys_setresuid"},
		{Name: "sys_getresuid"},
		{Name: "sys_setresgid"},
		{Name: "sys_getresgid"},
		{Name: "sys_getpgid"},
		{Name: "sys_setfsuid"},
		{Name: "sys_setfsgid"},
		{Name: "sys_getsid"},
		{Name: "sys_capget"},
		{Name: "sys_capset"},
		{Name: "sys_rt_sigpending"},
		{Name: "sys_rt_sigtimedwait"},
		{Name: "sys_rt_sigqueueinfo"},
		{Name: "sys_rt_sigsuspend"},
		{Name: "sys_sigaltstack"},
		{Name: "sys_utime"},
		{Name: "sys_mknod"},
		{Name: "sys_uselib"},
		{Name: "sys_personality"},
		{Name: "sys_ustat"},
		{Name: "sys_statfs"},
		{Name: "sys_fstatfs"},
		{Name: "sys_sysfs"},
		{Name: "sys_getpriority"},
		{Name: "sys_setpriority"},
		{Name: "sys_sched_setparam"},
		{Name: "sys_sched_getparam"},
		{Name: "sys_sched_setscheduler"},
		{Name: "sys_sched_getscheduler"},
		{Name: "sys_sched_get_priority_max"},
		{Name: "sys_sched_get_priority_min"},
		{Name: "sys_sched_rr_get_interval"},
		{Name: "sys_mlock"},
		{Name: "sys_munlock"},
		{Name: "sys_mlockall"},
		{Name: "sys_munlockall"},
		{Name: "sys_vhangup"},
		{Name: "sys_modify_ldt"},
		{Name: "sys_pivot_root"},
		{Name: "sys__sysctl"},
		{Name: "sys_prctl"},
		{Name: "sys_arch_prctl"},
		{Name: "sys_adjtimex"},
		{Name: "sys_setrlimit"},
		{Name: "sys_chroot"},
		{Name: "sys_sync"},
		{Name: "sys_acct"},
		{Name: "sys_settimeofday"},
		{Name: "sys_mount"},
		{Name: "sys_umount2"},
		{Name: "sys_swapon"},
		{Name: "sys_swapoff"},
		{Name: "sys_reboot"},
		{Name: "sys_sethostname"},
		{Name: "sys_setdomainname"},
		{Name: "sys_iopl"},
		{Name: "sys_ioperm"},
		{Name: "sys_create_module"},
		{Name: "sys_init_module"},
		{Name: "sys_delete_module"},
		{Name: "sys_get_kernel_syms"},
		{Name: "sys_query_module"},
		{Name: "sys_quotactl"},
		{Name: "sys_nfsservctl"},
		{Name: "sys_getpmsg"},
		{Name: "sys_putpmsg"},
		{Name: "sys_afs_syscall"},
		{Name: "sys_tuxcall"},
		{Name: "sys_security"},
		{Name: "sys_gettid"},
		{Name: "sys_readahead"},
		{Name: "sys_setxattr"},
		{Name: "sys_lsetxattr"},
		{Name: "sys_fsetxattr"},
		{Name: "sys_getxattr"},
		{Name: "sys_lgetxattr"},
		{Name: "sys_fgetxattr"},
		{Name: "sys_listxattr"},
		{Name: "sys_llistxattr"},
		{Name: "sys_flistxattr"},
		{Name: "sys_removexattr"},
		{Name: "sys_lremovexattr"},
		{Name: "sys_fremovexattr"},
		{Name: "sys_tkill"},
		{Name: "sys_time"},
		{Name: "sys_futex"},
		{Name: "sys_sched_setaffinity"},
		{Name: "sys_sched_getaffinity"},
		{Name: "sys_set_thread_area"},
		{Name: "sys_io_setup"},
		{Name: "sys_io_destroy"},
		{Name: "sys_io_getevents"},
		{Name: "sys_io_submit"},
		{Name: "sys_io_cancel"},
		{Name: "sys_get_thread_area"},
		{Name: "sys_lookup_dcookie"},
		{Name: "sys_epoll_create"},
		{Name: "sys_epoll_ctl_old"},
		{Name: "sys_epoll_wait_old"},
		{Name: "sys_remap_file_pages"},
		{Name: "sys_getdents64"},
		{Name: "sys_set_tid_address"},
		{Name: "sys_restart_syscall"},
		{Name: "sys_semtimedop"},
		{Name: "sys_fadvise64"},
		{Name: "sys_timer_create"},
		{Name: "sys_timer_settime"},
		{Name: "sys_timer_gettime"},
		{Name: "sys_timer_getoverrun"},
		{Name: "sys_timer_delete"},
		{Name: "sys_clock_settime"},
		{Name: "sys_clock_gettime"},
		{Name: "sys_clock_getres"},
		{Name: "sys_clock_nanosleep"},
		{Name: "sys_exit_group"},
		{Name: "sys_epoll_wait"},
		{Name: "sys_epoll_ctl"},
		{Name: "sys_tgkill"},
		{Name: "sys_utimes"},
		{Name: "sys_vserver"},
		{Name: "sys_mbind"},
		{Name: "sys_set_mempolicy"},
		{Name: "sys_get_mempolicy"},
		{Name: "sys_mq_open"},
		{Name: "sys_mq_unlink"},
		{Name: "sys_mq_timedsend"},
		{Name: "sys_mq_timedreceive"},
		{Name: "sys_mq_notify"},
		{Name: "sys_mq_getsetattr"},
		{Name: "sys_kexec_load"},
		{Name: "sys_waitid"},
		{Name: "sys_add_key"},
		{Name: "sys_request_key"},
		{Name: "sys_keyctl"},
		{Name: "sys_ioprio_set"},
		{Name: "sys_ioprio_get"},
		{Name: "sys_inotify_init"},
		{Name: "sys_inotify_add_watch"},
		{Name: "sys_inotify_rm_watch"},
		{Name: "sys_migrate_pages"},
		{Name: "sys_openat"},
		{Name: "sys_mkdirat"},
		{Name: "sys_mknodat"},
		{Name: "sys_fchownat"},
		{Name: "sys_futimesat"},
		{Name: "sys_newfstatat"},
		{Name: "sys_unlinkat"},
		{Name: "sys_renameat"},
		{Name: "sys_linkat"},
		{Name: "sys_symlinkat"},
		{Name: "sys_readlinkat"},
		{Name: "sys_fchmodat"},
		{Name: "sys_faccessat"},
		{Name: "sys_pselect6"},
		{Name: "sys_ppoll"},
		{Name: "sys_unshare"},
		{Name: "sys_set_robust_list"},
		{Name: "sys_get_robust_list"},
		{Name: "sys_splice"},
		{Name: "sys_tee"},
		{Name: "sys_sync_file_range"},
		{Name: "sys_vmsplice"},
		{Name: "sys_move_pages"},
		{Name: "sys_utimensat"},
		{Name: "sys_epoll_pwait"},
		{Name: "sys_signalfd"},
		{Name: "sys_timerfd_create"},
		{Name: "sys_eventfd"},
		{Name: "sys_fallocate"},
		{Name: "sys_timerfd_settime"},
		{Name: "sys_timerfd_gettime"},
		{Name: "sys_accept4"},
		{Name: "sys_signalfd4"},
		{Name: "sys_eventfd2"},
		{Name: "sys_epoll_create1"},
		{Name: "sys_dup3"},
		{Name: "sys_pipe2"},
		{Name: "sys_inotify_init1"},
		{Name: "sys_preadv"},
		{Name: "sys_pwritev"},
		{Name: "sys_rt_tgsigqueueinfo"},
		{Name: "sys_perf_event_open"},
		{Name: "sys_recvmmsg"},
		{Name: "sys_fanotify_init"},
		{Name: "sys_fanotify_mark"},
		{Name: "sys_prlimit64"},
		{Name: "sys_name_to_handle_at"},
		{Name: "sys_open_by_handle_at"},
		{Name: "sys_clock_adjtime"},
		{Name: "sys_syncfs"},
		{Name: "sys_sendmmsg"},
		{Name: "sys_setns"},
		{Name: "sys_getcpu"},
		{Name: "sys_process_vm_readv"},
		{Name: "sys_process_vm_writev"},
		{Name: "sys_kcmp"},
		{Name: "sys_finit_module"},
		{Name: "sys_sched_setattr"},
		{Name: "sys_sched_getattr"},
		{Name: "sys_renameat2"},
		{Name: "sys_seccomp"},
		{Name: "sys_getrandom"},
		{Name: "sys_memfd_create"},
		{Name: "sys_kexec_file_load"},
		{Name: "sys_bpf"},
		{Name: "sys_userfaultfd"},
		{Name: "sys_membarrier"},
		{Name: "sys_mlock2"},
		{Name: "sys_copy_file_range"},
		{Name: "sys_pkey_mprotect"},
		{Name: "sys_pkey_alloc"},
		{Name: "sys_pkey_free"},
	}
)

func BytesToUint(b []byte) uint {
	buf := bytes.NewBuffer(b)

	switch len(b) {
	case 1:
		var x uint8
		binary.Read(buf, binary.LittleEndian, &x)
		return uint(x)
	case 2:
		var x uint16
		binary.Read(buf, binary.LittleEndian, &x)
		return uint(x)
	case 4:
		var x uint32
		binary.Read(buf, binary.LittleEndian, &x)
		return uint(x)
	default:
		var x uint64
		binary.Read(buf, binary.LittleEndian, &x)
		return uint(x)
	}
}
