likema / linux_syscall_hook Goto Github PK

                            .                          ..         .
                           @88>                  < .z@8"`        @88>
   .u    .                 %8P      u.    u.      !@88E          %8P      u.    u.
 .d88B :@8c        u        .     x@88k u@88c.    '888E   u       .     x@88k u@88c.      uL
="8888f8888r    us888u.   .@88u  ^"8888""8888"     888E u@8NL   .@88u  ^"8888""8888"  .ue888Nc..
  4888>'88"  .@88 "8888" ''888E`   8888  888R      888E`"88*"  ''888E`   8888  888R  d88E`"888E`
  4888> '    9888  9888    888E    8888  888R      888E .dN.     888E    8888  888R  888E  888E
  4888>      9888  9888    888E    8888  888R      888E~8888     888E    8888  888R  888E  888E
 .d888L .+   9888  9888    888E    8888  888R      888E '888&    888E    8888  888R  888E  888E
 ^"8888*"    9888  9888    888&   "*88*" 8888"     888E  9888.   888&   "*88*" 8888" 888& .888E
    "Y"      "888*""888"   R888"    ""   'Y"     '"888*" 4888"   R888"    ""   'Y"   *888" 888&
              ^Y"   ^Y'     ""                      ""    ""      ""                  `"   "888E
                                                                                     .dWi   `88E
                                                                                     4888~  J8%
                                                                                      ^"===*"`
"rain wont drop until i say so"
---------------------------------------------
a collection of tests and random bits that will eventually make up a rootkit


/ARM_write_protect_disable - flip write protection bit of vaddr through pagetable
/direct_hook_test - system call hooking via directly over-writing sys_call_table
    - some useful header files here
        -> resolve_kallsyms.h: does exactly as youd expect, uses kprobes to find kallsyms_lookup_name and then uses that to resolve syms
        -> set_page_flags.h: given a vaddr, set its corresponding PTEs flags
        -> direct_syscall_hook.h: ftrace-like wrapper for direct hooking of sys_call_table
/fg-kaslr_test - fg-kaslr bypass, this isnt actually anything important i was just using pr_info wrong
/ftrace_hook_epic_fail - FTRACE_OPS_FL_SAVE_REGS is not supported on arm64 and i spent 2 days debugging this, however this will work on x86
/phe - partial homomorphic encryption of LKM, unfinished
/exception_handler hooking - THIS IS THE COOLEST ONE, hooks exception handler and redirects to 2 different tables based on syscall #, original table unmodified
/assembler - assembles mov absolute address for shellcode generation on the fly without leaving kernelmode !

todo:
- dropper
- find fg-kaslr offsets via bootkit
- overwrite ftrace records
- integrate functionality of my other projects into this one
- finish rk scanner hiding via PHE
- process hiding from usermode
- network connection hiding from usermode
- redirect entire sys_call_table
- use OP-TEE to hide functions




new exception hooking process:
copy (el0_svc_common entry, length x) -> hooked_el0_svc_common
copy shellcode (jmp hooked_el0_svc_common, length x) -> el0_svc_common

el0_svc_common entry
0 ---------------
jmp hooked_el0_svc_common
x ---------------
el0_svc_common body

>>>>>>>>>>>

hooked_el0_svc_common entry
0 ---------------
OVERWRITTEN el0_svc_common body
x ---------------
set sys_call_table to new addr
jmp el0_svc_common entry + x