I am starting to develop kernel modules and I wonder about all methods to know which modules are running in order to remove them (include modules that they are hide).
E.g. The following module has two lines in order to hide him. (It is a typical rootkit development trick)
#include <linux/module.h>
#include <linux/init.h>
#include <linux/kernel.h>
MODULE_LICENSE("GPL");
int example_init(void);
void example_exit(void);
module_init(example_init);
module_exit(example_exit);
int example_init(void) {
list_del_init(&__this_module.list); // Deletes entry from list and reinitialize it
kobject_del(&THIS_MODULE->mkobj.kobj); // Unlink kobject from hierarchy
printk("Example: module loaded\n");
return 0;
}
void example_exit(void) {
printk("Example: module removed\n");
}
When a module is loaded you can see the information with dmesg, lsmod, modinfo, modprobe, /proc/modules, /sys/module or /proc/kallsyms
My question is if exist ways to know (and remove) this module? obviusly, rmmod doesn't work because this module doesn't appear in /proc/modules list.