linux-rootkit

Feature-rich interactive rootkit that targets Linux kernel 4.19, accompanied by a dynamic kernel memory analysis GDB plugin for in vivo introspection (e.g. using QEMU)
git clone git://git.deurzen.net/linux-rootkit
Log | Files | Refs

commit c33c65e54388ecc98af64cf09b961cd93f829dfe
Author: deurzen <m.deurzen@tum.de>
Date:   Fri, 20 Nov 2020 07:58:28 +0100

initial

Diffstat:
AMakefile | 10++++++++++
Asrc/g7.c | 102+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Asrc/ioctl.c | 14++++++++++++++
Asrc/ioctl.h | 18++++++++++++++++++
4 files changed, 144 insertions(+), 0 deletions(-)

diff --git a/Makefile b/Makefile @@ -0,0 +1,10 @@ +obj-m += g7.o +g7-objs := ./src/g7.o ./src/ioctl.o + +KERNELDIR := /lib/modules/$(shell uname -r)/build + +all: + make -C $(KERNELDIR) M=$(PWD) modules + +clean: + make -C $(KERNELDIR) M=$(PWD) clean diff --git a/src/g7.c b/src/g7.c @@ -0,0 +1,102 @@ +#include <linux/fs.h> +#include <linux/init.h> +#include <linux/kernel.h> +#include <linux/module.h> +#include <linux/mutex.h> +#include <linux/proc_fs.h> +#include <linux/uaccess.h> + +#include "ioctl.h" + +#define BUFLEN 4096 + + +static int __init g7_init(void); +static void __exit g7_exit(void); + +static int g7_open(struct inode *, struct file *); +static int g7_release(struct inode *, struct file *); +static ssize_t g7_read(struct file *, char __user *, size_t, loff_t *); +static ssize_t g7_write(struct file *, const char *, size_t, loff_t *); +static long g7_ioctl(struct file *, unsigned int, unsigned long); + + +static struct mutex lock; +static char buf[BUFLEN]; + +static struct file_operations g7_fops = +{ + .owner = THIS_MODULE, + .read = g7_read, + .write = g7_write, + .open = g7_open, + .unlocked_ioctl = g7_ioctl, + .release = g7_release, +}; + + + +static int +g7_open(struct inode *inode, struct file *file) +{ + printk(KERN_INFO "g7_open\n"); + return 0; +} + +static int +g7_release(struct inode *inode, struct file *file) +{ + printk(KERN_INFO "g7_release\n"); + return 0; +} + +static ssize_t +g7_read(struct file *filp, char __user *buf, size_t len, loff_t *off) +{ + printk(KERN_INFO "g7_read\n"); + return 0; +} + +static ssize_t +g7_write(struct file *filp, const char __user *buf, size_t len, loff_t *off) +{ + printk(KERN_INFO "g7_write\n"); + return 0; +} + +static long +g7_ioctl(struct file *file, unsigned int cmd, unsigned long arg) +{ + switch (cmd) { + case G7_PING: handle_ping(arg); break; + default: break; + } + + return 0; +} + + +static int +g7_init(void) +{ + mutex_init(&lock); + proc_create_data(G7_DEVICE, S_IRUSR | S_IWUSR, 0, &g7_fops, buf); + + printk(KERN_INFO "g7 initialized\n"); + + return 0; +} + +static void +g7_exit(void) +{ + remove_proc_entry(G7_DEVICE, 0); +} + + +MODULE_LICENSE("GPL"); +MODULE_AUTHOR("Group 7"); +MODULE_DESCRIPTION("Assignment 3"); + +module_init(g7_init); +module_exit(g7_exit); diff --git a/src/ioctl.c b/src/ioctl.c @@ -0,0 +1,14 @@ +#include <linux/kernel.h> +#include <linux/module.h> + +#include "ioctl.h" + + +void +handle_ping(unsigned long arg) +{ + if (!strcmp("PING", (const char *)arg)) { + printk(KERN_INFO "caught PING\n"); + printk(KERN_INFO "sending PONG\n"); + } +} diff --git a/src/ioctl.h b/src/ioctl.h @@ -0,0 +1,18 @@ +#ifndef _GROUP7_CHARDEV_H +#define _GROUP7_CHARDEV_H + +#include <linux/ioctl.h> + +#define G7_MAGIC_NUMBER '@' +#define G7_DEVICE "G7RKP" + +#define G7_PING _IOWR(G7_MAGIC_NUMBER, 0x0, char *) + +#define G7_WRITE _IOW(G7_MAGIC_NUMBER, 0x1, char *) +#define G7_READ _IOW(G7_MAGIC_NUMBER, 0x2, char *) + + +void handle_ping(unsigned long); + + +#endif//_GROUP7_CHARDEV_H