f0rb1dd3n / Reptile

LKM Linux rootkit
2.53k stars 571 forks source link

Can't open reptile_module.ko for reading #97

Open LevitatingBusinessMan opened 3 years ago

LevitatingBusinessMan commented 3 years ago

First of all when I started bulding I got an error 'struct mm_struct' has no member named 'mmap_sem'. I resolved this by changng instances of mmap_sem to mmap_lock. Now when I try to build I get these errors:

make[1]: Entering directory '/usr/lib/modules/5.8.12-arch1-1/build'
make[1]: Entering directory '/home/rein/Reptile/userland'
Can't open /home/rein/Reptile/output/reptile_module.ko for reading
  CC      /home/rein/Reptile/output/shell
make: *** [Makefile:31: kmatryoshka] Error 255
make: *** Waiting for unfinished jobs....
  CC      /home/rein/Reptile/output/cmd
make[1]: Leaving directory '/home/rein/Reptile/userland'
  MODPOST /home/rein/Reptile/output/Module.symvers
ERROR: modpost: "kallsyms_on_each_symbol" [/home/rein/Reptile/output/reptile_module.ko] undefined!
make[2]: *** [scripts/Makefile.modpost:111: /home/rein/Reptile/output/Module.symvers] Error 1
make[2]: *** Deleting file '/home/rein/Reptile/output/Module.symvers'
make[1]: *** [Makefile:1665: modules] Error 2
make[1]: Leaving directory '/usr/lib/modules/5.8.12-arch1-1/build'
make: *** [Makefile:35: module] Error 2

/home/rein/Reptile/output/reptile_module.ko does not exist

I'll add, I am running arch linux with kernel 5.8.12

minhbq-99 commented 3 years ago

Hi, I think it is because CONFIG_KALLSYMS is not set in your kernel, you can check it in /usr/lib/modules/5.8.12-arch1-1/build/.config

LevitatingBusinessMan commented 3 years ago

@minhbq-99 Thanks for relying. Seems like the settings is turned on.

cat /usr/lib/modules/5.8.12-arch1-1/build/.config | grep CONFIG_KALLSYMS
CONFIG_KALLSYMS=y
CONFIG_KALLSYMS_ALL=y
CONFIG_KALLSYMS_ABSOLUTE_PERCPU=y
CONFIG_KALLSYMS_BASE_RELATIVE=y
minhbq-99 commented 3 years ago

@LevitatingBusinessMan I've found out the problem, this commit: https://github.com/torvalds/linux/commit/0bd476e6c67190b5eb7b6e105c8db8ff61103281 unexported the kallsyms_on_each_symbol so now out-of-tree modules cannot use this function anymore

COOLMSF commented 1 year ago

Hi, I think it is because CONFIG_KALLSYMS is not set in your kernel, you can check it in /usr/lib/modules/5.8.12-arch1-1/build/.config

I have CONFIG_KALLSYMS, but also make failed. [root@VM-16-2-centos 2]# cat /usr/lib/modules/3.10.0-1160.71.1.el7.x86_64/build/.config | grep CONFIG_KALLSYMS CONFIG_KALLSYMS=y CONFIG_KALLSYMS_ALL=y