Chapter 5 hiding processes using 2.4 series kernel modules the unauthorized reproduction in whole or
in part of this publication in any form is prohibited.
We will now get to know how the tools LS mode I in S mode and our mode work
let's copy the files required to implement the goals described in this chapter
each core module is characterized by a specific structure.
We will now compile our first module and test its function
as we can see the module has been uploaded correctly in the logs the record Hello World appears.
After unloading the module we can see the character string the end in the logs that we saved in the
code of our module.
Let's compile and test the test Dotsie module as example.
It shows the current working directory using the strace program.
We will now check which system function and application really calls
as we can see the program setting and current directory uses the get c w d system function
Let's try now to substitute get C-w calls with our own function our second module performs this task
changing a pointer in the Sisk call table as required.
After uploading the core module the value returned by the get C W D function has been falsified.
Now we will dedicate ourselves to hiding processes.
Let's check which system function the program uses.
Using the get dense function the program lists the content of the proc directory that includes information
about current processes.
Our task will be to filter the structures of the different directories so as to allow a specific process
to be hidden.
This operation will be executed by our next module.
Let's have a closer look at it and configure it before uploading.
After uploading the module the ID 9 1 6 process.
In this case the sists logged is not visible in the program.
Additionally we have hidden the slash home slash user's folder.
Everything has gone according to plan.
After unloading the module with the remote command the situation returned to normal.