Hi,
since I heard that there are some newer rootkits which won't be detected by chkrootkit I'd like to check the running kernels symbol table against the compiled System.map. Is there a somewhat more detailed HOW-TO for doing this? The how-to's I've found by Googling usually only mention that I shall compare the tables with GDB. Can somebody tell me what exactly shall be done in GDB? (Because I haven't used it yet before.)
Thanks,
Botond
