Casper-fs：一款功能强大的自定义隐藏Linux内核模块生成器

git clone https://github.com/CoolerVoid/casper-fs.git

$ uname -r

$ cd casper-fs/module_generator
$ sudo python3 -m pip install -r requirements.txt

$ cat module_generator/rules/fs-rules.yaml
binary_name: casperfs
module_name: Casperfs
unhide_module_key: AbraKadabra
hide_module_key: Shazam
fake_device_name: usb15
unhide-hide-file-key: Alakazam
unprotect-protect-file-key: Sesame
fs-rules:
- hidden:
   1: secret.txt
   2: my_vault.db
- protect:
   1: backup_httpd.log

- protect:
   1: backup_httpd.log
   2: secret_img.iso
   3: secret_file.img
   4: secret_file2.img
   5: secret_file3.img

$ python3 casper-fs-gen.py --rules rules/fs-rules.yaml

# dnf update
# dnf install kernel-headers.x86_64 kernel-modules.x86_64 kernel.x86_64 kernel-devel kmod

apt install linux-headers-generic gcc make

# cd output; make clean; make
# insmod casperfs.ko

$ touch secret.txt
$ ls
-- no results--
$ echo "Alakazam" > /dev/usb15
$ ls
secret.txt
$ echo "Alakazam" > /dev/usb15
$ ls
-- no results--

# ls
test.txt  log.txt backup_httpd.log
# rm backup_httpd.log
# ls
test.txt  log.txt backup_httpd.log
# echo "Sesame" > /dev/usb15            // to remove protection
# rm backup_httpd.log
# ls
test.txt  log.txt
# echo "Sesame" > /dev/usb15    // to active protection again

# rmmod casperfs
rmmod: ERROR: ../libkmod/libkmod-module.c:799 kmod_module_remove_module() could not remove 'casperfs': No such file or directory
rmmod: ERROR: could not remove module casperfs: No such file or directory
# lsmod | grep casper
# echo "Shazam" > /dev/usb15
# lsmod | grep casper
casperfs
# rmmod casperfs