This script takes the file to splat over run-init while assembling ramdisks as a command-line argument. It then calls update-initramfs and splats over the run-init as the ramdisks are being assembled.

This script takes the file to splat over run-init while assembling ramdisks as a command-line argument. It then calls update-initramfs and splats over the run-init as the ramdisks are being assembled.

• A. horsepill_setopt
• B. ramdisk_patch
• C. ramdisk_infect
• D. horsepill_infect

Answer: (D)

The scenario centers on infecting a boot image by introducing a payload into the early init process inside the ramdisk as it’s being built. Replacing run-init with a malicious payload during the ramdisk assembly and then rebuilding the image with update-initramfs is exactly how a boot-time infection is injected, so the payload runs as the system boots. The term horsepill_infect fits this behavior because it specifically denotes infecting boot-time components (the ramdisk and its run-init) with a payload during the initramfs creation process. The other options describe more generic ramdisk modification methods (patching or infecting without the boot-time context or without the particular naming convention used for this technique), which don’t capture the exact operation described.

The scenario centers on infecting a boot image by introducing a payload into the early init process inside the ramdisk as it’s being built. Replacing run-init with a malicious payload during the ramdisk assembly and then rebuilding the image with update-initramfs is exactly how a boot-time infection is injected, so the payload runs as the system boots. The term horsepill_infect fits this behavior because it specifically denotes infecting boot-time components (the ramdisk and its run-init) with a payload during the initramfs creation process. The other options describe more generic ramdisk modification methods (patching or infecting without the boot-time context or without the particular naming convention used for this technique), which don’t capture the exact operation described.