The Linux Kernel Module Programming Guide (updated for 5.0+ kernels)

Utility to find hidden Linux kernel modules

LKM rootkit for Linux x86 with the 2.6 kernel. It inserts salts inside system_call and sysenter_entry.

An example rootkit that gives a userland process root permissions

ModTracer Finds Hidden Linux Kernel Rootkits and then make visible again.

A local LKM rootkit loader/dropper that lists available security mechanisms

A rootkit for Android.

Tools to bypass flawed SELinux policies using the init_module system call

A quick LKM rootkit that executes a reverse TCP netcat shell with root privileges.

Virtual Linux block device driver for simulating and performing I/O.

Make an Linux Kernel rootkit visible again.

Rust out-of-tree Linux Kernel Modules (LKMs) experimentation framework

64-bit LKM Rootkit builder based on yaml prescription. Working on 5.15.5 kernel

Cheat sheet to detect and remove linux kernel rootkit

Reverse shell and rootkit

kunkillable is an LKM that makes userland processes unkillable.

Linux kernel programming using loadable kernel modules (LKMs)

🔫 lkm module for emergency binary/script execution

Ftrace Based Linux Loadable Kernel Module Rootkit for Linux Kernel 5.x and 6.x on x86_64, hides files, hides process, hides bind shell & reverse shell port, privilege escalation, cleans up logs and bash history during installation

Very Easy Relative Backdoor Application