Home

Detection Tool

This is a simple LKM tool meant to detect LKM rootkits on Linux.

Features

• Detect Hidden PIDs
• Detect Hidden Files
• Detect Hooked Functions
• Detect Hidden Modules

Tested Environments

• Ubuntu 16.04 (4.15.0-45-generic)

Installation

NOTE: Ensure SMAP is disabled (most rootkits will not work with it enabled anyway)

git clone https://github.com/lckjosh/DetectionTool.git
cd DetectionTool
make
gcc client.c -o client

Usage

sudo insmod detectiontool.ko
./client [option]

Options:
[-p] detect hidden PIDs
[-f] detect hidden files
[-s] detect hooked functions
[-m] detect hidden modules

Explanation of Functions

Detect Hidden PIDs

Adapted from the unhide project.
This function compares the outputs of the following system calls:

• kill
• getpriority
• getpgid
• getsid
• sched_getaffinity
• sched_getparam
• sched_getscheduler
• sched_rr_get_interval

along with

• "/proc" entries
• "ps" command.

Detect Hidden Files

Detect Hooked Functions

Detect Hidden Modules