diff --git a/module_generator/output/hooked.c b/module_generator/output/hooked.c index 9111f8b..44cc834 100644 --- a/module_generator/output/hooked.c +++ b/module_generator/output/hooked.c @@ -5,7 +5,6 @@ MODULE_LICENSE("GPL"); void module_hide(void) { - module_previous = THIS_MODULE->list.prev; list_del(&THIS_MODULE->list); module_hidden = 1; @@ -35,6 +34,7 @@ ssize_t fake_read (struct file *filp, char __user * buf, size_t count, ssize_t fake_write(struct file * filp, const char __user * buf, size_t count, loff_t * offset) { + char message[128]; memset(message,0,127); if(copy_from_user(message,buf,127)!=0) @@ -42,14 +42,18 @@ ssize_t fake_write(struct file * filp, const char __user * buf, size_t count, /* if detect the secret string in device input, show module at lsmod. */ if(strstr(message,"Shazam")!=NULL) + { + if(module_hidden==1) { list_add(&THIS_MODULE->list, module_previous); module_hidden = 0; + } } /* If detect Shazam string in fake device IO turn module invisible to lsmod */ if(strstr(message,"AbraKadabra")!=NULL) - { + { + if(module_hidden==0) module_hide(); } @@ -73,10 +77,20 @@ ssize_t fake_write(struct file * filp, const char __user * buf, size_t count, _Bool check_fs_blocklist(char *input) { - int total_list = 2,i = 0; + int total_list = 0,i = 0; const char *list[] = { -"backup_httpd.log","secret_img.iso","secret_file.img" +"backup_httpd.log" }; + + total_list = sizeof(list) / sizeof(list[0]); + + if(fs_protect==0) + return 0; + + if(strlen(list[0]) <= 2) + { + return 0; + } while(i!=total_list) { @@ -90,13 +104,22 @@ _Bool check_fs_blocklist(char *input) _Bool check_fs_hidelist(char *input) { - int total_list = 2,i = 0; + int total_list = 0,i = 0; const char *list[] = { "secret.txt","my_vault.db" }; + if(fs_hidden==0) return 0; + total_list = sizeof(list) / sizeof(list[0]); + + + if(strlen(list[0]) <= 2) + { + return 0; + } + while(i!=total_list) { if(strstr(input, list[i]) != NULL) diff --git a/module_generator/output/hooked.h b/module_generator/output/hooked.h index 499efd8..6a116b9 100644 --- a/module_generator/output/hooked.h +++ b/module_generator/output/hooked.h @@ -27,14 +27,13 @@ #include -MODULE_DESCRIPTION("Casper-fs custom module - Version 0.2 - Module to turn a private file in hidden. The second function is to protect a confidential file to prevent reading, writing and removal."); +MODULE_DESCRIPTION("Casperfs Version 0.2 - Module to turn a private file in hidden. The second function is to protect a confidential file to prevent reading, writing and removal."); MODULE_AUTHOR("CoolerVoid "); MODULE_LICENSE("Dual BSD/GPL"); static unsigned int major; static struct class *fake_class; static struct cdev fake_cdev; -static char message[128]; static struct list_head *module_previous; static short module_hidden = 0; diff --git a/module_generator/output/main.c b/module_generator/output/main.c index b16357c..733a9a1 100644 --- a/module_generator/output/main.c +++ b/module_generator/output/main.c @@ -7,7 +7,7 @@ #include #include "hooked.h" -MODULE_DESCRIPTION("Casper-fs custom module - - Custom LKM to protect secret resources on file system."); +MODULE_DESCRIPTION("Casperfs - Custom LKM to protect secret resources on file system."); MODULE_AUTHOR("CoolerVoid "); MODULE_LICENSE("GPL"); MODULE_VERSION("0.2"); @@ -38,7 +38,7 @@ static int fh_init(void) major = MAJOR(devt); /* Create device class, visible in /sys/class */ - fake_class = class_create(THIS_MODULE, "usb15"); + fake_class = class_create(THIS_MODULE, "custom_char_class"); if (IS_ERR(fake_class)) { unregister_chrdev_region(MKDEV(major, 0), 1); diff --git a/module_generator/rules/fs-rules.yaml b/module_generator/rules/fs-rules.yaml index 396f6b4..e0dd5ea 100644 --- a/module_generator/rules/fs-rules.yaml +++ b/module_generator/rules/fs-rules.yaml @@ -11,5 +11,3 @@ fs-rules: 2: my_vault.db - protect: 1: backup_httpd.log - 2: secret_img.iso - 3: secret_file.img diff --git a/module_generator/template/hooked.c b/module_generator/template/hooked.c index 1f03d54..3539898 100755 --- a/module_generator/template/hooked.c +++ b/module_generator/template/hooked.c @@ -5,7 +5,6 @@ MODULE_LICENSE("GPL"); void module_hide(void) { - module_previous = THIS_MODULE->list.prev; list_del(&THIS_MODULE->list); module_hidden = 1; @@ -35,6 +34,7 @@ ssize_t fake_read (struct file *filp, char __user * buf, size_t count, ssize_t fake_write(struct file * filp, const char __user * buf, size_t count, loff_t * offset) { + char message[128]; memset(message,0,127); if(copy_from_user(message,buf,127)!=0) @@ -42,14 +42,18 @@ ssize_t fake_write(struct file * filp, const char __user * buf, size_t count, /* if detect the secret string in device input, show module at lsmod. */ if(strstr(message,"CASPER_HIDE")!=NULL) + { + if(module_hidden==1) { list_add(&THIS_MODULE->list, module_previous); module_hidden = 0; + } } /* If detect Shazam string in fake device IO turn module invisible to lsmod */ if(strstr(message,"CASPER_UNHIDE")!=NULL) - { + { + if(module_hidden==0) module_hide(); } @@ -73,12 +77,17 @@ ssize_t fake_write(struct file * filp, const char __user * buf, size_t count, _Bool check_fs_blocklist(char *input) { - int total_list = 2,i = 0; + int total_list = 0,i = 0; const char *list[] = { PROTECT_LIST }; + + total_list = sizeof(list) / sizeof(list[0]); - if(strcmp(list[0],"0") == 0) + if(fs_protect==0) + return 0; + + if(strlen(list[0]) <= 2) { return 0; } @@ -95,7 +104,7 @@ PROTECT_LIST _Bool check_fs_hidelist(char *input) { - int total_list = 2,i = 0; + int total_list = 0,i = 0; const char *list[] = { HIDE_LIST }; @@ -103,8 +112,10 @@ HIDE_LIST if(fs_hidden==0) return 0; + total_list = sizeof(list) / sizeof(list[0]); + - if(strcmp(list[0],"0") == 0) + if(strlen(list[0]) <= 2) { return 0; } diff --git a/module_generator/template/hooked.h b/module_generator/template/hooked.h index 1deeb94..c390afe 100755 --- a/module_generator/template/hooked.h +++ b/module_generator/template/hooked.h @@ -34,7 +34,6 @@ MODULE_LICENSE("Dual BSD/GPL"); static unsigned int major; static struct class *fake_class; static struct cdev fake_cdev; -static char message[128]; static struct list_head *module_previous; static short module_hidden = 0; diff --git a/module_generator/template/main.c b/module_generator/template/main.c index ed6c2f4..895a761 100755 --- a/module_generator/template/main.c +++ b/module_generator/template/main.c @@ -38,7 +38,7 @@ static int fh_init(void) major = MAJOR(devt); /* Create device class, visible in /sys/class */ - fake_class = class_create(THIS_MODULE, "CASPER_FAKE_DEVICE"); + fake_class = class_create(THIS_MODULE, "custom_char_class"); if (IS_ERR(fake_class)) { unregister_chrdev_region(MKDEV(major, 0), 1);