sec 4

add Makefile for sec3

support 5.15.0

Add hide remote port (#11) ...

Cast `v` argument in `hook_tcp4_seq_show()` to `struct inet_sock` instead of `sock`, and compare `inet_sport` and `inet_dport` fields for port `8080`. Remote connections on port 8080 now hidden as well as listening ports.

added further info links and missed credits

Revert "Merge pull request #6 from alfonmga/fixes1" ...

This reverts commit eb4a62d, reversing
changes made to 7e063f7.

Merge pull request #6 from alfonmga/fixes1 ...

fix: add <linux/version.h> include

fix: add <linux/version.h> include

Merge pull request #5 from xcellerator/kprobe ...

Add support for kernel version 5.7+

update readmes

replace file_operations with proc_fops for proc_create() in kernel 5.6+

fix x64 syscall names

ftrace_helper fixes

remove __x64_ prefix from 3.5

remove __x64_ prefix from 3.4

remove __x64_ prefix from 3.3

update 3.5 to use new ftrace_helper for 5.7+

update 3.4 to use new ftrace_helper for 5.7+

add missing unregister_kprobe()

resolve kallsyms_lookup_name via kprobes

Merge pull request #4 from xcellerator/gcc-warnings ...

Fix gcc warnings

fix format string warnings

cast 0x1 to pointer to sock struct before comparison

move error declaration above code for 3.5

move error declaration above code for 3.4

fix kernel buffer double-free

add blog link

add link to blog

add hiding logged in users

add link to blog

add blog link 06

add blog link 05

add link to blog 04

add link to writeup

privileged container escapes

wrong syscall name

add link to blog post

Merge pull request #2 from xcellerator/wip ...

Char device interference

image in readme

interfering with random and urandom read requests works!

add 16.04 support comment

Merge pull request #1 from xcellerator/wip ...

Rewrite rootkit examples to use ftrace instead of sys_call_table[] method

5.3: updated to use ftrace instead of old method

The age of tabs is over. The age of spaces has begun.

The age of tabs is over. The age of spaces has begun.

Add explanation for why on earth we have the same function repeated four times

Add linux_dirent struct block to PTREGS hook_getdents()

Fix for kernel versions <4.17 ...

The old linux_dirent struct isn't in the kernel headers anymore - even on 16.04
Declaring it manually allows us to copy the structure into kernel memory and dereference it later

3.4: tabs to spaces

working on support for < 4.17

update to use ftrace

update readme

fix function declaration

update to use ftrace

update version number

updated readme and add helper

add section 3 readme

remove ftrace comments

add check for x64 to correct syscall name

fix typo

rewrite module using ftrace

remove wip test.sh

Merge branch 'wip' ...

Hiding local listening sockets on port 8080 now works!

updated readme for hiding ports

hiding port 8080 now works!

hide ports: builds and hooks, still needs guts

ignore .vagrant

doesn't work yet because we have to assign a function to __tcp4_seq_show, not a function pointer

hooking appears to work, but no effect yet

hiding ports wip

add hide processes

fix section number

add directory hiding

make a process root

add rootkit line to output

fix typo in readme

hiding lkms with custom signals

more code

markdown typo

mkdir hook now works!

fix duplicate

change folder name

hook sys_mkdir, but pathname not correct

add inspiration

add hiding lkms

update readme

update readme

patching chown in memory!

replace example with sed

remove error

dynamically inject an LKM

update gitignore

loading from memory

kpatch example and instructions

code commenting

add tested on line

livepatch sample

restructure

update title

git ignore for sanity

device file example

add link

test case for make

add ubuntu line

add note

basic lkm

add repo readme

add gitignore

Initial commit