Unhide the hidden module in linux kernel

The name of the pictureThe name of the pictureThe name of the pictureClash Royale CLAN TAG#URR8PPP











up vote
1
down vote

favorite












I coded a LKM which has a functionality of hiding itself from procfs and sysfs. The problem is when I try to unhide it I get the following error :libkmod: ERROR ../libkmod/libkmod-module.c:1882 kmod_module_get_holders: could not open '/sys/module/my_module/holders': No such file or directory. After this I can see the module is shown in the lsmod but with the -2 as the parent PID. When i try to remove the module I get the error saying ERROR: Module my_module is builtin.. Here is the code:



//HIDE
void hide(void)
if(module_hidden) //is hidden
return;
module_prev = THIS_MODULE->list.prev;
list_del_init(&THIS_MODULE->list); //procfs view

kobject_prev = &THIS_MODULE->mkobj.kobj;
kobject_parent_prev = THIS_MODULE->mkobj.kobj.parent;
kobject_list_prev = THIS_MODULE->mkobj.kobj.entry.prev;

kobject_del(&THIS_MODULE->mkobj.kobj); //sysfs view
//list_del(&THIS_MODULE->mkobj.kobj.entry);
module_hidden = (unsigned int)0x1;



//SHOW
void unhide(void)
if(!module_hidden) //is not hidden
return;
list_add(&THIS_MODULE->list, module_prev); //procfs view

//list_add(&THIS_MODULE->mkobj.kobj.entry, kobject_list_prev);
kobject_add(kobject_prev, kobject_parent_prev, "my_module");//sysfs view
module_hidden = (unsigned int)0x0;



What can be the problem?



Thanks.










share|improve this question

























    up vote
    1
    down vote

    favorite












    I coded a LKM which has a functionality of hiding itself from procfs and sysfs. The problem is when I try to unhide it I get the following error :libkmod: ERROR ../libkmod/libkmod-module.c:1882 kmod_module_get_holders: could not open '/sys/module/my_module/holders': No such file or directory. After this I can see the module is shown in the lsmod but with the -2 as the parent PID. When i try to remove the module I get the error saying ERROR: Module my_module is builtin.. Here is the code:



    //HIDE
    void hide(void)
    if(module_hidden) //is hidden
    return;
    module_prev = THIS_MODULE->list.prev;
    list_del_init(&THIS_MODULE->list); //procfs view

    kobject_prev = &THIS_MODULE->mkobj.kobj;
    kobject_parent_prev = THIS_MODULE->mkobj.kobj.parent;
    kobject_list_prev = THIS_MODULE->mkobj.kobj.entry.prev;

    kobject_del(&THIS_MODULE->mkobj.kobj); //sysfs view
    //list_del(&THIS_MODULE->mkobj.kobj.entry);
    module_hidden = (unsigned int)0x1;



    //SHOW
    void unhide(void)
    if(!module_hidden) //is not hidden
    return;
    list_add(&THIS_MODULE->list, module_prev); //procfs view

    //list_add(&THIS_MODULE->mkobj.kobj.entry, kobject_list_prev);
    kobject_add(kobject_prev, kobject_parent_prev, "my_module");//sysfs view
    module_hidden = (unsigned int)0x0;



    What can be the problem?



    Thanks.










    share|improve this question























      up vote
      1
      down vote

      favorite









      up vote
      1
      down vote

      favorite











      I coded a LKM which has a functionality of hiding itself from procfs and sysfs. The problem is when I try to unhide it I get the following error :libkmod: ERROR ../libkmod/libkmod-module.c:1882 kmod_module_get_holders: could not open '/sys/module/my_module/holders': No such file or directory. After this I can see the module is shown in the lsmod but with the -2 as the parent PID. When i try to remove the module I get the error saying ERROR: Module my_module is builtin.. Here is the code:



      //HIDE
      void hide(void)
      if(module_hidden) //is hidden
      return;
      module_prev = THIS_MODULE->list.prev;
      list_del_init(&THIS_MODULE->list); //procfs view

      kobject_prev = &THIS_MODULE->mkobj.kobj;
      kobject_parent_prev = THIS_MODULE->mkobj.kobj.parent;
      kobject_list_prev = THIS_MODULE->mkobj.kobj.entry.prev;

      kobject_del(&THIS_MODULE->mkobj.kobj); //sysfs view
      //list_del(&THIS_MODULE->mkobj.kobj.entry);
      module_hidden = (unsigned int)0x1;



      //SHOW
      void unhide(void)
      if(!module_hidden) //is not hidden
      return;
      list_add(&THIS_MODULE->list, module_prev); //procfs view

      //list_add(&THIS_MODULE->mkobj.kobj.entry, kobject_list_prev);
      kobject_add(kobject_prev, kobject_parent_prev, "my_module");//sysfs view
      module_hidden = (unsigned int)0x0;



      What can be the problem?



      Thanks.










      share|improve this question













      I coded a LKM which has a functionality of hiding itself from procfs and sysfs. The problem is when I try to unhide it I get the following error :libkmod: ERROR ../libkmod/libkmod-module.c:1882 kmod_module_get_holders: could not open '/sys/module/my_module/holders': No such file or directory. After this I can see the module is shown in the lsmod but with the -2 as the parent PID. When i try to remove the module I get the error saying ERROR: Module my_module is builtin.. Here is the code:



      //HIDE
      void hide(void)
      if(module_hidden) //is hidden
      return;
      module_prev = THIS_MODULE->list.prev;
      list_del_init(&THIS_MODULE->list); //procfs view

      kobject_prev = &THIS_MODULE->mkobj.kobj;
      kobject_parent_prev = THIS_MODULE->mkobj.kobj.parent;
      kobject_list_prev = THIS_MODULE->mkobj.kobj.entry.prev;

      kobject_del(&THIS_MODULE->mkobj.kobj); //sysfs view
      //list_del(&THIS_MODULE->mkobj.kobj.entry);
      module_hidden = (unsigned int)0x1;



      //SHOW
      void unhide(void)
      if(!module_hidden) //is not hidden
      return;
      list_add(&THIS_MODULE->list, module_prev); //procfs view

      //list_add(&THIS_MODULE->mkobj.kobj.entry, kobject_list_prev);
      kobject_add(kobject_prev, kobject_parent_prev, "my_module");//sysfs view
      module_hidden = (unsigned int)0x0;



      What can be the problem?



      Thanks.







      linux linux-kernel kernel-modules c






      share|improve this question













      share|improve this question











      share|improve this question




      share|improve this question










      asked Sep 27 '17 at 6:28









      rustam Shirinov

      61




      61

























          active

          oldest

          votes











          Your Answer







          StackExchange.ready(function()
          var channelOptions =
          tags: "".split(" "),
          id: "106"
          ;
          initTagRenderer("".split(" "), "".split(" "), channelOptions);

          StackExchange.using("externalEditor", function()
          // Have to fire editor after snippets, if snippets enabled
          if (StackExchange.settings.snippets.snippetsEnabled)
          StackExchange.using("snippets", function()
          createEditor();
          );

          else
          createEditor();

          );

          function createEditor()
          StackExchange.prepareEditor(
          heartbeatType: 'answer',
          convertImagesToLinks: false,
          noModals: false,
          showLowRepImageUploadWarning: true,
          reputationToPostImages: null,
          bindNavPrevention: true,
          postfix: "",
          onDemand: true,
          discardSelector: ".discard-answer"
          ,immediatelyShowMarkdownHelp:true
          );



          );













           

          draft saved


          draft discarded


















          StackExchange.ready(
          function ()
          StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f394683%2funhide-the-hidden-module-in-linux-kernel%23new-answer', 'question_page');

          );

          Post as a guest



































          active

          oldest

          votes













          active

          oldest

          votes









          active

          oldest

          votes






          active

          oldest

          votes















           

          draft saved


          draft discarded















































           


          draft saved


          draft discarded














          StackExchange.ready(
          function ()
          StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f394683%2funhide-the-hidden-module-in-linux-kernel%23new-answer', 'question_page');

          );

          Post as a guest













































































          Popular posts from this blog

          Peggy Mitchell

          Palaiologos

          The Forum (Inglewood, California)