Diving into kernel security with an anti-rootkit project.
Rootkits and their counters, one step at a time.
FinishedKernel moduleC, Linux kernelGPL-3.0
An anti-rootkit Linux kernel module, written in 2022 as a way to learn kernel security. The point was less the finished module than the path to it: look at the kernel structures a rootkit abuses, write a small attack, then write the defense. AppArmor and SELinux were out of scope.
The target was kernel 4.0 and newer, but the work starts on 2.4 and 2.6. They lack the protections of later kernels, the literature covers them well, and the demonstrations are much easier there.
The repository is a series of steps, each with an "attack" and a "defense" module. The defense has to be loaded first.
| Step | Topic |
|---|---|
| 00 | testing |
| 01 | hooking: sys_call_table overwrites, inline patching, and the defenses of copying the table or hashing function code |
| 02 | hiding: how Diamorphine, Ivyl's rootkit and Suterusu hide processes, files and themselves |
| 03 | triggering: scanning on writes to /proc/ark, and on kernel taint via kprobes on add_taint |
| 04 | restructuring: portability across kernel versions with LINUX_VERSION_CODE |
Along the way it moved through kernels 2.4, 2.6, 4.4 and 5.15, tested on Slackware and Alpine. On 5.7+ kallsyms_lookup_name is no longer exported, so the 5.15 defense recovers it through kprobes, the same trick rootkits use.
Finished as a learning project; untouched since April 2022. Each step has its own README with the reasoning. The top-level README lists the papers, books and other repositories it drew on, including tyton and linux_kernel_hacking.