perf stat -e exceptions:page_fault_user --filter "address > 0xffff000000000000"

Detect illegal access to kernel space, potentially useful for Meltdown detection

Based on capsule8 agent examples, not rigorously tested

0
By: kodoque
2018-01-17 19:16:10

These Might Interest You

  • Access www.kernel.org and download the last stable linux kernel release. Show Sample Output


    0
    wget --no-check-certificate https://www.kernel.org/$(wget -qO- --no-check-certificate https://www.kernel.org | grep tar | head -n1 | cut -d\" -f2)
    glaudiston · 2013-11-07 18:46:14 0
  • Watch the temperatures of your CPU cores in real time at the command line. Press CONTROL+C to end. GORY DETAILS: Your computer needs to support sensors (many laptops, for example, do not). You'll need to install the lm-sensors package if it isn't already installed. And it helps to run the `sensors-detect` command to set up your sensor kernel modules first. At the very end of the sensors-detect interactive shell prompt, answer YES to add the new lines to the list of kernel modules loaded at boot. Show Sample Output


    1
    while :; do sensors|grep ^Core|while read x; do printf '% .23s\n' "$x"; done; sleep 1 && clear; done;
    linuxrawkstar · 2011-04-20 06:41:57 2
  • Analyze an Apache access log for the time period with most activity and display the hit count, requesting IP and the timestamp. May help detect a brute force dos attack.


    2
    cut -d " " -f1,4 access_log | sort | uniq -c | sort -rn | head
    zlemini · 2013-09-20 21:29:32 0
  • Where < target > may be a single IP, a hostname or a subnet -sS TCP SYN scanning (also known as half-open, or stealth scanning) -P0 option allows you to switch off ICMP pings. -sV option enables version detection -O flag attempt to identify the remote operating system Other option: -A option enables both OS fingerprinting and version detection -v use -v twice for more verbosity. nmap -sS -P0 -A -v < target >


    18
    nmap -sS -P0 -sV -O <target>
    starchox · 2009-02-18 07:32:03 4
  • Gets the (previously obtainable with: finger @kernel.org ) info of the latest linux kernel versions available. Show Sample Output


    0
    curl 'https://www.kernel.org/kdist/finger_banner'
    Testuser_01 · 2012-03-04 21:10:19 0
  • One base component is our hardware detection. It is a C++ library and app and is designed after a dynamic structure. Any kind of hardware, no matter if usb or pci, can be configured by mhwd. There is just a simple configuration file which tells mhwd what to do. This way we also support hybrid graphics cards out of the box. However there are currently only mhwd configs for nvidia optimus setups. But this gap will be filled soon. Just play with some of those commands to get a feeling about mhwd. Show Sample Output


    1
    mhwd --help
    unixmonkey57489 · 2013-05-16 14:30:18 0

What do you think?

Any thoughts on this command? Does it work on your machine? Can you do the same thing with only 14 characters?

You must be signed in to comment.

What's this?

commandlinefu.com is the place to record those command-line gems that you return to again and again. That way others can gain from your CLI wisdom and you from theirs too. All commands can be commented on, discussed and voted up or down.

Share Your Commands



Stay in the loop…

Follow the Tweets.

Every new command is wrapped in a tweet and posted to Twitter. Following the stream is a great way of staying abreast of the latest commands. For the more discerning, there are Twitter accounts for commands that get a minimum of 3 and 10 votes - that way only the great commands get tweeted.

» http://twitter.com/commandlinefu
» http://twitter.com/commandlinefu3
» http://twitter.com/commandlinefu10

Subscribe to the feeds.

Use your favourite RSS aggregator to stay in touch with the latest commands. There are feeds mirroring the 3 Twitter streams as well as for virtually every other subset (users, tags, functions,…):

Subscribe to the feed for: