*** DESCRIPTION ***

Curuncula is a tool shipped as a loadable kernel module which aims to detect
rootkits based on the Intel debugging support facilities; rootkits which
set the GD access flag are also detected.
It makes use of the "last branch recording" mechanism provided by the Intel
architecture; see the description in the code for more details.
Available for Linux kernel version 2.4 and 2.6, but easily adaptable for
other x86 operating systems.

*** NOTES ***

Smart rootkits already hosted in the system could escape detection by
redirecting the execution flow of the detector, thus making it give negative
response: this could be avoided equipping the detector with a self-modifying
code or polymorphic engine.
Another way an installed rootkit could trick the detection is by preventing
the detector from installing itself, though this approach is raw and easily
notified.
However, remember not to trust a subverted system, ever.

*** WARNING ***

This tool comes completely untested and unsupported.

Author: Giuseppe Cocomazzi (sbudella)
Contact: sbudella@gmail.com
