.vscode/settings.json

{
    "files.associations": {
        "time.h": "c",
        "constants.h": "c",
        "pkt_cls.h": "c",
        "map_common.h": "c",
        "regex.h": "c",
        "unistd.h": "c",
        "kit.h": "c",
        "module_manager.h": "c",
        "modules.h": "c",
        "libbpf.h": "c",
        "bpf_tracing.h": "c",
        "ptrace.h": "c",
        "stat.h": "c",
        "udp.h": "c",
        "tcp.h": "c",
        "if_link.h": "c",
        "netlink.h": "c",
        "bpf_helper_defs.h": "c",
        "bpf.h": "c",
        "stddef.h": "c",
        "ring_buffer.h": "c",
        "bpf_helpers.h": "c",
        "tcp_helper.h": "c",
        "stdio.h": "c"
    }
}
Updated project structure, and added new list for the next incoming feature. 2021-12-21 20:08:49 -05:00			`{`
			`"files.associations": {`
Added more communication utils between userspace and kernel: * Included maps and kernel ring buffer communication * Extended the ebpf structure to include more modules * New utils in both user and kernelspace * Other changes * This update precedes a great effort on researching and learning and linux kernel tracing and studing ebpfkit from defcon. More functionalities should come rather quickly now. 2021-12-29 14:44:09 -05:00			`"time.h": "c",`
			`"constants.h": "c",`
			`"pkt_cls.h": "c",`
Added new kprobe to the filesystem ebpf section. Now receiving read events, and storing them in a map for later use, along with a reference to the user-space memory buffer 2022-01-14 21:18:51 -05:00			`"map_common.h": "c",`
Included a global config struct for controlling which hooks and functions of the rootkit should be active. Still work to be done in the bpf side 2021-12-31 09:54:47 -05:00			`"regex.h": "c",`
			`"unistd.h": "c",`
Updated file names and directory structure to the new multi-modules rootkit 2022-01-16 06:56:54 -05:00			`"kit.h": "c",`
Included a global config struct for controlling which hooks and functions of the rootkit should be active. Still work to be done in the bpf side 2021-12-31 09:54:47 -05:00			`"module_manager.h": "c",`
Completed configuration module which enables to change the running ebpf modules in the rootkit at runtime. Minor changes and updated code structure 2022-01-04 13:26:13 -05:00			`"modules.h": "c",`
[BUILD IS FAILING] Added file system hooks and other improvements. Uploading because of needing to backup 2022-01-04 20:09:59 -05:00			`"libbpf.h": "c",`
[BUILD FAILING] Checkpoint for backup, added new hook for file system, tweaked makefile for real kernel header files inclusion, still not working. Commiting for periodic backup 2022-01-05 20:34:53 -05:00			`"bpf_tracing.h": "c",`
			`"ptrace.h": "c",`
Fixed the whole header setup, now correctly using the kernel headers instead of normal development ones. Ready to go on with original plan of file system hooking 2022-01-06 13:31:52 -05:00			`"stat.h": "c",`
			`"udp.h": "c",`
			`"tcp.h": "c",`
			`"if_link.h": "c",`
			`"netlink.h": "c",`
Added new kprobe to the filesystem ebpf section. Now receiving read events, and storing them in a map for later use, along with a reference to the user-space memory buffer 2022-01-14 21:18:51 -05:00			`"bpf_helper_defs.h": "c",`
Completed output modification of sys_read. Created a simple PoC 2022-01-16 06:45:45 -05:00			`"bpf.h": "c",`
Added new hooks and updated map fields to support new sudo module. 2022-02-05 13:49:20 -05:00			`"stddef.h": "c",`
Added new TC module, updates to the exec hooking system and the userland module 2022-02-20 16:50:15 -05:00			`"ring_buffer.h": "c",`
			`"bpf_helpers.h": "c",`
Successfully added uprobes calculation and hooking at arbitrary function of execve_hijack. 2022-03-03 05:53:51 -05:00			`"tcp_helper.h": "c",`
			`"stdio.h": "c"`
Updated project structure, and added new list for the next incoming feature. 2021-12-21 20:08:49 -05:00			`}`
			`}`