Class 09 · KP 12 / 25

Linux: Loadable Kernel Module Rootkits

SSDT hook: redirect a syscall (e.g. NtQueryDirectoryFile) to hide artifacts.

Most Linux kernel rootkits ship as an LKM (.ko) loaded

with insmod.

static int __init rk_init(void) {
    hide_module();          /* remove self from module list */
    hook_syscalls();        /* intercept getdents, etc.     */
    return 0;
}
static void __exit rk_exit(void) { unhook_syscalls(); }

module_init(rk_init);
module_exit(rk_exit);
MODULE_LICENSE("GPL");      /* lie so the kernel loads us    */

Once loaded, the module runs in ring 0 with full access to kernel memory.