admin/TripleCross
1
0
Fork 0
mirror of https://github.com/h3xduck/TripleCross.git synced 2025-12-24 02:13:07 +08:00
Code Issues Packages Projects Releases Wiki Activity

Added support for integrating the execution hijacker via the rootkit. Still some work to do, also changed some config from fs which needs to be reverted

Browse Source
This commit is contained in:
h3xduck
2022-02-18 09:08:54 -05:00
parent 0e022a8385
commit 130364e6ab
14 changed files with 2151 additions and 2047 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/ebpf/include/bpf/defs.h
View File

@@ -31,6 +31,14 @@ struct fs_priv_open{ //Map
} fs_open SEC(".maps");
//State of the execve hijacker. 0 inactive, 1 active
struct exec_var_priv_hijack_active{ //Map
__uint(type, BPF_MAP_TYPE_HASH);
__uint(max_entries, 1);
__type(key, __u64);
__type(value, __u64);
} exec_var_hijack_active SEC(".maps");
/*PROTECTED MAPS*/
//Any attempt to access these maps will be blocked by the rootkit if the program is not whitelisted