<?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>Linux on THALIUM</title><link>/tags/linux/</link><description>Recent content in Linux on THALIUM</description><generator>Hugo</generator><language>en-us</language><copyright>Copyright (c) 2026, all rights reserved.</copyright><lastBuildDate>Wed, 12 Mar 2025 08:00:00 +0000</lastBuildDate><atom:link href="/tags/linux/index.xml" rel="self" type="application/rss+xml"/><item><title>Linux kernel Rust module for rootkit detection</title><link>/posts/linux-kernel-rust-module-for-rootkit-detection/</link><pubDate>Wed, 12 Mar 2025 08:00:00 +0000</pubDate><guid>/posts/linux-kernel-rust-module-for-rootkit-detection/</guid><description>The introduction of Rust into the Linux kernel allows to write kernel drivers in Rust, which we can use to build a kernel-level EDR. This post explores this possibility by designing various checks to detect kernel-level rootkits and implementing them using the kernel&amp;rsquo;s Rust API. We then discuss the experience of developing in Rust within the Linux kernel.</description></item><item><title>ECW 2023: Centralized Memory (write-up)</title><link>/posts/ecw-2023-centralized-memory-write-up/</link><pubDate>Tue, 07 Nov 2023 12:00:00 +0100</pubDate><guid>/posts/ecw-2023-centralized-memory-write-up/</guid><description>&lt;strong&gt;Centralized Memory&lt;/strong&gt; was a hard Linux pwn challenge created for the European Cyber Week CTF 2023 qualifiers. This write-up covers the intended method of exploitation through a race condition, an AES padding bug and a stack overflow.</description></item><item><title>kSMBd: a quick overview</title><link>/posts/ksmbd-trailer/</link><pubDate>Fri, 12 May 2023 12:00:00 +0000</pubDate><guid>/posts/ksmbd-trailer/</guid><description>In this blogpost, we introduce the analysis of one SMB implementation: kSMBd. It will be followed up by a talk at OffensiveCon 2023 named &amp;ldquo;Abusing Linux in-kernel SMB server to gain kernel remote code execution&amp;rdquo;.</description></item></channel></rss>