mncoppola / suterusu

An LKM rootkit targeting Linux 2.6/3.x on x86(_64), and ARM
MIT License
635 stars 210 forks source link

Couldn't be compiled on 4.x Linux(which I have expected) #9

Open targetnull opened 8 years ago

targetnull commented 8 years ago

Hi, I'm trying it on the 4.4.0 arm linux and it couldn't be compiled, saying that

main.c:255:28: error: ‘struct file’ has no member named ‘f_dentry’ afinfo = PDE_DATA(filep->f_dentry->d_inode);

But I have expected this because the file structure could change from version to version. I'd like to know wether you plan to update this project to support the latest kernel. If you don't, could you provide me with some reference where I can find such examples?

BTW, since you can do hijackings, is there a way to defend such attacks? Take the keylogger as an example, you have registered a modified keyboad notifier, is there any method to prevent an unauthorized process from doing so?

Thanks

bzgo commented 8 years ago

This has not been tested, but it compiles now, theres 2 places in main.c that need this update:

if LINUX_VERSION_CODE < KERNEL_VERSION(3, 10, 0)

afinfo = PDE(filep->f_dentry->d_inode)->data;
#elif LINUX_VERSION_CODE < KERNEL_VERSION(3, 19, 0)
afinfo = PDE_DATA(filep->f_dentry->d_inode);
#else
afinfo = PDE_DATA(filep->f_path.dentry->d_inode);
#endif
q2dg commented 5 years ago

Well, nowadays we have arrived at 5.x version...

Mrdongzai commented 4 years ago

Well, nowadays we have arrived at 5.x version...

Hi, guys. I want to cross-compile it for Linux 4.1.x, but it threw out this error. What can I do? 1587189744(1) it seems that it points to wrong lib. the asm/bitsperlong.h is in arch/arm/include/asm.

Mrdongzai commented 4 years ago

Well, nowadays we have arrived at 5.x version...

image it's really strange. if I compile it in my Linux 4.15. it works well. but when I cross-compile it threw out the problem. 1587189744(1)