search

mncoppola / suterusu

An LKM rootkit targeting Linux 2.6/3.x on x86(_64), and ARM
MIT License
641 stars 210 forks source link

Make suterusu work on recent kernels #1

Closed vnd closed 11 years ago

vnd commented 11 years ago

f_vfsmnt was removed in 3.9 kernel (and was #defined as f_path.mnt in older kernels) http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=182be684784334598eee1d90274e7f7aa0063616

Starting from 3.11, iterate() is used instead of readdir(), see http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2233f31aade393641f0eaed43a71110e629bb900 I'm not terribly happy with preprocessor stuff, but can't think of anything better. Also, for consistency I remove o_ prefix from filldir and readdir functions. Tested on 3.11.0-12 2.6.38-8

vnd commented 11 years ago

The only remaining problem is port hiding -- it's broken due to proc_dir_entry changes in recent kernels. Opened an issue for this.

mncoppola commented 11 years ago

Thanks for the code and info, I'll look into the recent kernel changes and get things merged in soon.