admin/TripleCross
1
0
Fork 0
mirror of https://github.com/h3xduck/TripleCross.git synced 2025-12-27 11:53:09 +08:00
Code Issues Packages Projects Releases Wiki Activity

Updated file names and directory structure to the new multi-modules rootkit

Browse Source
This commit is contained in:
h3xduck
2022-01-16 06:56:54 -05:00
parent fc0d30f06f
commit 3832d99af1
14 changed files with 603 additions and 609 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
src/user/include/modules/fs.h
View File

@@ -5,24 +5,24 @@
#include <bpf/bpf.h>
#include <bpf/libbpf.h>
#include "common.h"
#include "xdp_filter.skel.h"
#include "kit.skel.h"
//Connections
int attach_kprobe_ksys_read(struct xdp_filter_bpf *skel){
int attach_kprobe_ksys_read(struct kit_bpf *skel){
skel->links.kprobe_ksys_read = bpf_program__attach(skel->progs.kprobe_ksys_read);
return libbpf_get_error(skel->links.kprobe_ksys_read);
}
int attach_kretprobe_vfs_read(struct xdp_filter_bpf *skel){
int attach_kretprobe_vfs_read(struct kit_bpf *skel){
skel->links.kretprobe_vfs_read = bpf_program__attach(skel->progs.kretprobe_vfs_read);
return libbpf_get_error(skel->links.kretprobe_vfs_read);
}
int attach_fs_all(struct xdp_filter_bpf *skel){
int attach_fs_all(struct kit_bpf *skel){
return attach_kprobe_ksys_read(skel) || attach_kretprobe_vfs_read(skel);
}
int detach_kprobe_ksys_read(struct xdp_filter_bpf *skel){
int detach_kprobe_ksys_read(struct kit_bpf *skel){
int err = detach_link_generic(skel->links.kprobe_ksys_read);
if(err<0){
fprintf(stderr, "Failed to detach fs link\n");
@@ -30,7 +30,7 @@ int detach_kprobe_ksys_read(struct xdp_filter_bpf *skel){
}
return 0;
}
int detach_kretprobe_vfs_read(struct xdp_filter_bpf *skel){
int detach_kretprobe_vfs_read(struct kit_bpf *skel){
int err = detach_link_generic(skel->links.kretprobe_vfs_read);
if(err<0){
fprintf(stderr, "Failed to detach fs link\n");
@@ -39,7 +39,7 @@ int detach_kretprobe_vfs_read(struct xdp_filter_bpf *skel){
return 0;
}
int detach_fs_all(struct xdp_filter_bpf *skel){
int detach_fs_all(struct kit_bpf *skel){
return detach_kprobe_ksys_read(skel) || detach_kretprobe_vfs_read(skel);
}

2
src/user/include/modules/module_manager.h
View File

@@ -34,7 +34,7 @@ typedef struct module_config_t{
//Configuration struct. Used by the module manager to
//correctly attach the needed modules, providing necessary params
typedef struct module_config_attr_t{
struct xdp_filter_bpf *skel;
struct kit_bpf *skel;
struct xdp_module_attr {
__u32 ifindex;
__u32 flags;

10
src/user/include/modules/sched.h
View File

@@ -5,21 +5,21 @@
#include <bpf/bpf.h>
#include <bpf/libbpf.h>
#include "common.h"
#include "xdp_filter.skel.h"
#include "kit.skel.h"
//Connections
int attach_handle_sched_process_exec(struct xdp_filter_bpf *skel){
int attach_handle_sched_process_exec(struct kit_bpf *skel){
skel->links.handle_sched_process_exec = bpf_program__attach(skel->progs.handle_sched_process_exec);
return libbpf_get_error(skel->links.handle_sched_process_exec);
}
int attach_sched_all(struct xdp_filter_bpf *skel){
int attach_sched_all(struct kit_bpf *skel){
return attach_handle_sched_process_exec(skel);
}
//Disconnections
int detach_handle_sched_process_exec(struct xdp_filter_bpf *skel){
int detach_handle_sched_process_exec(struct kit_bpf *skel){
int err = detach_link_generic(skel->links.handle_sched_process_exec);
if(err<0){
fprintf(stderr, "Failed to detach sched link\n");
@@ -28,7 +28,7 @@ int detach_handle_sched_process_exec(struct xdp_filter_bpf *skel){
return 0;
}
int detach_sched_all(struct xdp_filter_bpf *skel){
int detach_sched_all(struct kit_bpf *skel){
return detach_handle_sched_process_exec(skel);
}

10
src/user/include/modules/xdp.h
View File

@@ -6,9 +6,9 @@
#include <linux/if_link.h>
#include "common.h"
#include <sys/resource.h>
#include "xdp_filter.skel.h"
#include "kit.skel.h"
int attach_xdp_receive(struct xdp_filter_bpf *skel, __u32 ifindex, __u32 flags){
int attach_xdp_receive(struct kit_bpf *skel, __u32 ifindex, __u32 flags){
//Attach BPF program to network interface
//New way of doing it: it allows for future addition of multiple
//XDP programs attached to same interface if needed
@@ -54,12 +54,12 @@ int attach_xdp_receive(struct xdp_filter_bpf *skel, __u32 ifindex, __u32 flags){
return 0;
}
int attach_xdp_all(struct xdp_filter_bpf *skel, __u32 ifindex, __u32 flags){
int attach_xdp_all(struct kit_bpf *skel, __u32 ifindex, __u32 flags){
return attach_xdp_receive(skel, ifindex, flags);
}
int detach_xdp_receive(struct xdp_filter_bpf *skel){
int detach_xdp_receive(struct kit_bpf *skel){
int err = detach_link_generic(skel->links.xdp_receive);
if(err<0){
fprintf(stderr, "Failed to detach XDP program\n");
@@ -68,7 +68,7 @@ int detach_xdp_receive(struct xdp_filter_bpf *skel){
return 0;
}
int detach_xdp_all(struct xdp_filter_bpf *skel){
int detach_xdp_all(struct kit_bpf *skel){
return detach_xdp_receive(skel);
}