Report: Kernel Interrupt Table
The kernel interrupt table is the Linux kernel data structure that associates interrupts with the functions that handle them.
Table lookups are triggered by three types of events: hardware interrupts (e.g., keyboard keystrokes or I/O at a network port), software interrupts (e.g., call to the kernel to perform an I/O request), or processor exceptions (e.g., such as an access violation or divide by zero).
Report Detail: Kernel Interrupt Table
Following are the kernel interrupts at the instant the memory snapshot was taken of the centos 6 - 2.6.32-696.28.1.el6.x86_64 image from the samples gallery (requires authentication).
The following table describes each column of the reported data.
Column | Description | Notes |
---|---|---|
Id | Processor-defined ID of the interrupt | Values between 0x0 and 0x1F , inclusive, are reserved for exceptions; values larger than 0x1F are used for interrupt routines |
Addr | Handler address for the interrupt ID | |
Name | Name of the interrupt |
Forensic Hints
Patterns to look for: addresses that fall outside the standard range
Note that the Project Freta analysis engine infers the existence of rootkits and other hooks of these objects, and lists them in the Potential Rootkits report section.
This data cannot be obtained from a running Linux system, so an internal-external comparison is not possible.