Skip to content

Home

Jump to bottom
Joshua Lim edited this page Jun 10, 2020 · 50 revisions

Detection Tool

This is a simple LKM tool meant to detect LKM rootkits on Linux.

Features

  • Detect Hidden PIDs
  • Detect Hidden Files
  • Detect Hooked Functions
  • Detect Hidden Modules

Tested Environments

  • Ubuntu 16.04 (4.15.0-45-generic)

Installation

NOTE: Ensure SMAP is disabled (most rootkits will not work with it enabled anyway)

git clone https://github.com/lckjosh/DetectionTool.git
cd DetectionTool
make
gcc client.c -o client

Usage

sudo insmod detectiontool.ko
./client [option]

Options:
[-p] detect hidden PIDs
[-f] detect hidden files
[-s] detect hooked functions
[-m] detect hidden modules

Explanation of Functions

Detect Hidden PIDs

Detect Hidden Files

Detect Hooked Functions

Detect Hidden Modules

Clone this wiki locally