How to restore a hidden loadable kernel module from /sys/module and dealing with restoring holders_dir?
        Posted  
        
            by 
                user1833005
            
        on Stack Overflow
        
        See other posts from Stack Overflow
        
            or by user1833005
        
        
        
        Published on 2012-11-18T04:56:32Z
        Indexed on 
            2012/11/18
            4:59 UTC
        
        
        Read the original article
        Hit count: 260
        
I'm playing with kernel module hiding on Linux Kernel 3.x. I try to hide and recover the module from /sys/module. Everything works fine on Kernel Version 3.0 and 3.2.6, I can load and unload the module and hide and unhide it. When I'm unloading the module on kernel 3.6.6 I get the following error:
rmmod: ERROR: could not open '/sys/module/xxx/holders': No such file or directory rmmod: ERROR: Module xxx is in use
Has anybody an idea how I could restore of the module so that I am able to unload it without errors?
Here is my code:
/* hide from /sys/module */ 
kobject_del(&__this_module.mkobj.kobj);
list_del(&__this_module.mkobj.kobj.entry);
/* add to /sys/module */    
kobject_add(&__this_module.mkobj.kobj,__this_module.mkobj.kobj.parent,"xxx");
Thank you four help :)
© Stack Overflow or respective owner