ACPI kernel module to divert system power off from S5 to S4, S3, or system reboot

simple LKM template mostly as a demo

Linux Kernel Rootkit for modern kernels (6x)

A ring0 Loadable Kernel Module (Linux) for latest kernels 6.x

Linux low level lab (WIP)

Wrong Boot (codename: wrong8007) is a programmable dead man's switch for Linux, living entirely in kernel space.

Virtual Linux block device driver for simulating and performing I/O.

Utility to find hidden Linux kernel modules

HiddenGhost is an new solution for find system call table with support for 5.7x kernels +

「⚔️」Ring 0 Rootkit for Linux Kernels x86/x86_64 5.x/6.x

Kernel-space x86_64 Linux rootkit leveraging kprobes and ftrace for syscall hooking (hiding entries and reverse shell backdoor)

PoC LKM to force run cleanup_module() on other LKMs

Performance Enhancing Proxy for 5G mmWave Networks for Support For Non-interactive Applications. (Linux kernel module)

ModTracer Finds Hidden Linux Kernel Rootkits and then make visible again.

Make an Linux Kernel rootkit visible again.

A simple firewall service utilizing netfilter hooks and proc pseudo files in the Linux Κernel space to block/log network traffic

Named After the Scottish loch, Lomond is a simple example on how to use kprobes in an LKM for learning purposes and gainning a deeper understanding of the Linux kernel.

Módulo de kernel carregável que realiza requisições de I/O de acordo com a política C-SCAN.

A LKM (Loadable Kernel Module) to execute a command as root; I include a example of using netcat and a compiled(with source and steps on how to compile) reverse shell provided in C.