The Linux Kernel Module Programming Guide (updated for 5.0+ kernels)

Stealthy Linux Kernel Rootkit for modern kernels (6x)

Utility to find hidden Linux kernel modules

A ring0 Loadable Kernel Module (Linux) for latest kernels 6.x

ModTracer Finds Hidden Linux Kernel Rootkits and then make visible again.

LKM rootkit for Linux x86 with the 2.6 kernel. It inserts salts inside system_call and sysenter_entry.

Cheat sheet to detect and remove linux kernel rootkit

An example rootkit that gives a userland process root permissions

A rootkit for Android.

Make an Linux Kernel rootkit visible again.

Tools to bypass flawed SELinux policies using the init_module system call

Attacking the cleanup_module function of a kernel module

A local LKM rootkit loader/dropper that lists available security mechanisms

Rust out-of-tree Linux Kernel Modules (LKMs) experimentation framework

Virtual Linux block device driver for simulating and performing I/O.

A quick LKM rootkit that executes a reverse TCP netcat shell with root privileges.

Ftrace Based Linux Loadable Kernel Module Rootkit for Linux Kernel 5.x up to linux kernel 6.2 on x86_64, hides files, hides process, hides bind shell & reverse shell port, privilege escalation, cleans up logs and bash history during installation - developed by Antonius in 2023 manually

64-bit LKM Rootkit builder based on yaml prescription. Working on 5.15.5 kernel

「⚔️」Ring 0 Rootkit for Linux Kernels x86/x86_64 5.x/6.x

Kernel-space x86_64 Linux rootkit leveraging kprobes and ftrace for syscall hooking (hiding entries and reverse shell backdoor)