Debug Mode

Epirootkit includes a conditional logging system controlled by the debug_mode module parameter. When enabled, internal events are printed to the kernel log via printk.

Enabling Debug Mode

Debug mode is set at install time through the install script:

sudo ./install.sh install <ip> <port> <password> true

Setting the last argument to true enables debug logs. Setting it to false disables them.

How It Works

The debug_mode parameter is a boolean declared in utils/debug.c:

bool debug_mode = false;
module_param(debug_mode, bool, 0644);

Unlike other parameters (set with 0400), debug_mode uses permission 0644, meaning it can be toggled at runtime by root without reloading the module:

echo 1 > /sys/module/epirootkit/parameters/debug_mode   # Enable
echo 0 > /sys/module/epirootkit/parameters/debug_mode   # Disable

The DEBUG_LOG Macro

All conditional logging goes through the DEBUG_LOG macro defined in utils/debug.h:

#define DEBUG_LOG(fmt, ...) \
do { \
    if (debug_mode) \
        printk(fmt, ##__VA_ARGS__); \
} while (0)

This macro wraps printk and only outputs when debug_mode is true. Components that use DEBUG_LOG include:

• Privilege escalation (elevate-perms.c): logs successful/failed escalation attempts and /proc file creation/removal.

Viewing Logs

When debug mode is enabled, you can view the rootkit's logs using:

dmesg | grep epirootkit

Or follow logs in real time:

dmesg -w | grep epirootkit

warning

In a real-world scenario, leaving debug mode enabled makes the rootkit detectable through kernel logs. It should only be used during development and testing.