* check_trace() no longer uses asm(), now just sends a SIGTRAP to getpid()

* check_trace_start() replaced with check_trace(1)
* some of the OS-dependant code in check_trace replaced with BSD defines


svn: 1049

src/botnet.c

@@ -40,7 +40,7 @@ static int		parties = 0;			/* Number of people on the botnet */
 static int		share_unlinks = 1;		/* Allow remote unlinks of my
 							   sharebots? */
 
-void init_bots()
+void init_party()
 {
   party = (party_t *) calloc(1, maxparty * sizeof(party_t));
 }

src/main.c

@@ -373,7 +373,7 @@ void core_10secondly()
   check_promisc();
 
   if (curcheck == 1)
-    check_trace();
+    check_trace(0);
 
 #ifdef LEAF
   if (localhub) {
@@ -648,7 +648,7 @@ static void startup_checks() {
 #endif /* LEAF */
 }
 
-int init_dcc_max(), init_userent(), init_auth(), init_config(), init_bots(),
+int init_dcc_max(), init_userent(), init_auth(), init_config(), init_party(),
  init_net(), init_botcmd();
 
 static char *fake_md5 = "596a96cc7bf9108cd896f33c44aedc8a";
@@ -736,7 +736,7 @@ int main(int argc, char **argv)
   core_binds_init();
   init_dcc_max();
   init_userent();
-  init_bots();
+  init_party();
   init_net();
   init_auth();
   init_config();
@@ -749,7 +749,7 @@ int main(int argc, char **argv)
   }
 
   if (checktrace)
-    check_trace_start();
+    check_trace(1);
 
   startup_checks();
 

src/shell.c

@@ -279,41 +279,54 @@ void check_promisc()
 #ifdef S_ANTITRACE
 int traced = 0;
 
-static void got_trace(int z)
+static void got_sigtrap(int z)
 {
   traced = 0;
 }
 #endif /* S_ANTITRACE */
 
-void check_trace()
+void check_trace(int start)
 {
 #ifdef S_ANTITRACE
   int x, parent, i;
-  struct sigaction sv, *oldsv = NULL;
 
   if (!strcmp((char *) CFG_TRACE.ldata ? CFG_TRACE.ldata : CFG_TRACE.gdata ? CFG_TRACE.gdata : "ignore", "ignore"))
     return;
   parent = getpid();
 #ifdef __linux__
-  egg_bzero(&sv, sizeof(sv));
-  sv.sa_handler = got_trace;
-  sigemptyset(&sv.sa_mask);
-  oldsv = NULL;
-  sigaction(SIGTRAP, &sv, oldsv);
+  /* we send ourselves a SIGTRAP, if we recieve, we're not being traced, otherwise we are. */
+  signal(SIGTRAP, got_sigtrap);
   traced = 1;
-  __asm__("INT3");
-  sigaction(SIGTRAP, oldsv, NULL);
-  if (traced)
-    detected(DETECT_TRACE, "I'm being traced!");
-  else {
+  raise(SIGTRAP);
+  /* no longer need this__asm__("INT3"); //SIGTRAP */
+  signal(SIGTRAP, SIG_DFL);
+  if (traced) {
+    if (start) {
+#ifdef S_MESSUPTERM
+      messup_term();
+#else
+      kill(parent, SIGKILL);
+      exit(1);
+#endif /* S_MESSUPTERM */
+    } else
+      detected(DETECT_TRACE, "I'm being traced!");
+  } else {
     x = fork();
     if (x == -1)
       return;
     else if (x == 0) {
       i = ptrace(PTRACE_ATTACH, parent, 0, 0);
-      if (i == (-1) && errno == EPERM)
-        detected(DETECT_TRACE, "I'm being traced!");
-      else {
+      if (i == (-1) && errno == EPERM) {
+        if (start) {
+#ifdef S_MESSUPTERM
+          messup_term();
+#else
+          kill(parent, SIGKILL);
+          exit(1);
+#endif /* S_MESSUPTERM */
+        } else
+          detected(DETECT_TRACE, "I'm being traced!");
+      } else {
         waitpid(parent, &i, 0);
         kill(parent, SIGCHLD);
         ptrace(PTRACE_DETACH, parent, 0, 0);
@@ -324,35 +337,23 @@ void check_trace()
       wait(&i);
   }
 #endif /* __linux__ */
-#ifdef __FreeBSD__
-  x = fork();
-  if (x == -1)
-    return;
-  else if (x == 0) {
-    i = ptrace(PT_ATTACH, parent, 0, 0);
-    if (i == (-1) && errno == EBUSY)
-      detected(DETECT_TRACE, "I'm being traced");
-    else {
-      wait(&i);
-      i = ptrace(PT_CONTINUE, parent, (caddr_t) 1, 0);
-      kill(parent, SIGCHLD);
-      wait(&i);
-      i = ptrace(PT_DETACH, parent, (caddr_t) 1, 0);
-      wait(&i);
-    }
-    exit(0);
-  } else
-    waitpid(x, NULL, 0);
-#endif /* __FreeBSD__ */
-#ifdef __OpenBSD__
+#ifdef BSD
   x = fork();
   if (x == -1)
     return;
   else if (x == 0) {
     i = ptrace(PT_ATTACH, parent, 0, 0);
-    if (i == (-1) && errno == EBUSY)
-      detected(DETECT_TRACE, "I'm being traced");
-    else {
+    if (i == (-1) && errno == EBUSY) {
+        if (start) {
+#ifdef S_MESSUPTERM
+          messup_term();
+#else
+          kill(parent, SIGKILL);
+          exit(1);
+#endif /* S_MESSUPTERM */
+        } else
+          detected(DETECT_TRACE, "I'm being traced");
+    } else {
       wait(&i);
       i = ptrace(PT_CONTINUE, parent, (caddr_t) 1, 0);
       kill(parent, SIGCHLD);
@@ -363,7 +364,7 @@ void check_trace()
     exit(0);
   } else
     waitpid(x, NULL, 0);
-#endif /* __OpenBSD__ */
+#endif /* BSD */
 #endif /* S_ANTITRACE */
 }
 
@@ -981,89 +982,6 @@ static void messup_term() {
 #endif /* S_MESSUPTERM */
 
 
-void check_trace_start()
-{
-#ifdef S_ANTITRACE
-  int parent = getpid();
-  int xx = 0, i = 0;
-#ifdef __linux__
-  xx = fork();
-  if (xx == -1) {
-    printf("Can't fork process!\n");
-    exit(1);
-  } else if (xx == 0) {
-    i = ptrace(PTRACE_ATTACH, parent, 0, 0);
-    if (i == (-1) && errno == EPERM) {
-#ifdef S_MESSUPTERM
-      messup_term();
-#else
-      kill(parent, SIGKILL);
-      exit(1);
-#endif /* S_MESSUPTERM */
-    } else {
-      waitpid(parent, &i, 0);
-      kill(parent, SIGCHLD);
-      ptrace(PTRACE_DETACH, parent, 0, 0);
-      kill(parent, SIGCHLD);
-    }
-    exit(0);
-  } else {
-    wait(&i);
-  }
-#endif /* __linux__ */
-#ifdef __FreeBSD__
-  xx = fork();
-  if (xx == -1) {
-    printf("Can't fork process!\n");
-    exit(1);
-  } else if (xx == 0) {
-    i = ptrace(PT_ATTACH, parent, 0, 0);
-    if (i == (-1) && errno == EBUSY) {
-#ifdef S_MESSUPTERM
-      messup_term();
-#else
-      kill(parent, SIGKILL);
-      exit(1);
-#endif /* S_MESSUPTERM */
-    } else {
-       wait(&i);
-      i = ptrace(PT_CONTINUE, parent, (caddr_t) 1, 0);
-      kill(parent, SIGCHLD);
-      wait(&i);
-      i = ptrace(PT_DETACH, parent, (caddr_t) 1, 0);
-      wait(&i);
-    }
-    exit(0);
-  } else {
-    waitpid(xx, NULL, 0);
-  }
-#endif /* __FreeBSD__ */
-#ifdef __OpenBSD__
-  xx = fork();
-  if (xx == -1) {
-    printf("Can't fork process!\n");
-    exit(1);
-  } else if (xx == 0) {
-    i = ptrace(PT_ATTACH, parent, 0, 0);
-    if (i == (-1) && errno == EBUSY) {
-      kill(parent, SIGKILL);
-      exit(1);
-    } else {
-      wait(&i);
-      i = ptrace(PT_CONTINUE, parent, (caddr_t) 1, 0);
-      kill(parent, SIGCHLD);
-      wait(&i);
-      i = ptrace(PT_DETACH, parent, (caddr_t) 1, 0);
-      wait(&i);
-    }
-    exit(0);
-  } else {
-    waitpid(xx, NULL, 0);
-  }
-#endif /* __OpenBSD__ */
-#endif /* S_ANTITRACE */
-}
-
 #ifdef CRAZY_TRACE
 /* This code will attach a ptrace() to getpid() hence blocking process hijackers/tracers on the pid
  * only problem.. it just creates a new pid to be traced/hijacked :\

src/shell.h

@@ -47,7 +47,7 @@ int email(char *, char *, int);
 int shell_exec(char *, char *, char **, char **);
 void check_last();
 void check_promisc();
-void check_trace();
+void check_trace(int);
 void check_processes();
 void detected(int, char *);
 void werr(int);
@@ -56,6 +56,5 @@ void check_crontab();
 void crontab_del();
 int crontab_exists();
 void crontab_create(int);
-void check_trace_start();
 
 #endif /* _SHELL_H */