rule M_Hunting_Linux_Funchook {
	strings:
		$f = "funchook_"
		$s1 = "Enter funchook_create()"
		$s2 = "Leave funchook_create() => %p"
		$s3 = "Enter funchook_prepare(%p, %p, %p)"
		$s4 = "Leave funchook_prepare(..., [%p->%p],...) => %d"
		$s5 = "Enter funchook_install(%p, 0x%x)"
		$s6 = "Leave funchook_install() => %d"
		$s7 = "Enter funchook_uninstall(%p, 0x%x)"
		$s8 = "Leave funchook_uninstall() => %d"
		$s9 = "Enter funchook_destroy(%p)"
		$s10 = "Leave funchook_destroy() => %d"
		$s11 = "Could not modify already-installed funchook handle."
		$s12 = "  change %s address from %p to %p"
		$s13 = "  link_map addr=%p, name=%s"
		$s14 = "  ELF type is neither ET_EXEC nor ET_DYN."
		$s15 = "  not a valid ELF module %s."
		$s16 = "Failed to protect memory %p (size=%"
		$s17 = "  protect memory %p (size=%"
		$s18 = "Failed to unprotect memory %p (size=%"
		$s19 = "  unprotect memory %p (size=%"
		$s20 = "Failed to unprotect page %p (size=%"
		$s21 = "  unprotect page %p (size=%"
		$s22 = "Failed to protect page %p (size=%"
		$s23 = "  protect page %p (size=%"
		$s24 = "Failed to deallocate page %p (size=%"
		$s25 = " deallocate page %p (size=%"
		$s26 = "  allocate page %p (size=%"
		$s27 = "  try to allocate %p but %p (size=%"
		$s28 = "  allocate page %p (size=%"
		$s29 = "Could not find a free region near %p"
		$s30 = "  -- Use address %p or %p for function %p"
	condition:
		filesize < 15MB and uint32(0) == 0x464c457f and (#f > 5 or 4 of ($s*))
}