Detecting syscall hooks with side-channels

I submitted a paper to tmp.0ut Volume 5 that was published on Aug 23, 2026!

You can read the paper by clicking below

╭───────────────────────────────────────────────────────────────────────────╮ │ │ │ ▄▄▃▃ Detecting ▇▇█▃ ▃ ▅▅▇▆▄▃▃▃▅▄▅▅▇▇▆▆▁▃▅ ▃ ▃ ▃▃▃▃▃▃▃▁ │ │ ▃▃ ▃▅▃▃▃▃▅▃▅▃▃▃▃▃▃▅▅▃▁▁▁ ▁▄▃ syscall ▃▃ hooks ▃ ▃▃▃ │ │ ▅▅▅▅▅▅▅▅▃ with ▄▄▁ ▃▃ ▃▃▄ side-channels ▃▃ │ │ ▃▅▃▃▃ ▃▃▁ ▃▃▅▅▃ ▁ ▃▃▃▃▃▁ ▃▅▅▅▄▃▃▃▅▅▃ ▃ ▅▅▅▇▅▅▅ │ │ │ │ ~ PinkNoize │ ╰───────────────────────────────────────────────────────────────────────────╯

Why did I choose to research and write about this?

I had wanted to do use a cache side channel for a bit, and given an increase of interest with rootkits in the community, I figured I would do something that would combine the two. As a lot of rootkit stealth techniques involve making the OS lie, I decided to see if I could use a side-channel to get around this.