KO
|
EN
gitlite — search
Search
#typescript
#ai-agents
#deepseek-harness
#dsh-plugin
#open-source
#ai
#claude-code
#cli
#windows
#codex
#developer-tools
#dsh
Imperius
★ 58
Open GitHub ↗
Make an Linux Kernel rootkit visible again.
Download README (.md)
Explore Similar Repositories
lkml.wtf
:
Source code for lkml.wtf.
Solaris
:
A local LKM rootkit loader/dropper that lists available security mechanisms
sandfly-kernel-module-decloak
:
Scripts to decloak Linux Loadable Kernel Module (LKM) stealth rootkits.
lkml-bot
:
监控 Linux 内核及其他系统软件邮件列表的机器人
Rebellion
:
「⚔️」Ring 0 Rootkit for Linux Kernels x86/x86_64 5.x/6.x
// repository documentation
Was this content helpful?
★ 0
(0 ratings)
Select Rating:
★
★
★
★
★
Submit Feedback
Recent Feedback
×
Download README
Do you want to download the
README.md
file for
Imperius
?
Download (.md)
# Imperius Make an LKM rootkit visible again. It involves getting the address of the "module_show" function from a rootkit, for example the diamorphine rootkit, and using it to call it, adding it back to lsmod, making it possible to remove an LKM rootkit. We can obtain the function address in very simple kernels using */sys/kernel/tracing/available_filter_functions_addrs*, however, it is only available from kernel 6.5x onwards. An alternative to this is to scan the kernel memory, and later add it to lsmod again, so that it can be removed, such as ModTracer: https://github.com/MatheuZSecurity/ModTracer (But there are still ways to bypass it, maybe I'll make a post about it soon). So in summary, this LKM abuses the function of lkm rootkits that have the functionality to become visible again. Join in Rootkit Researchers Group https://discord.gg/66N5ZQppU7
