A Linux Kernel Module (LKM) rootkit for hiding processes, granting root privileges, and making files invisible.
Diamorphine is a Linux Kernel Module (LKM) rootkit that allows users to hide processes, grant root privileges, and conceal files on Linux systems. It operates by intercepting kernel functions to manipulate system behavior, making it a tool for exploring kernel security and rootkit mechanics. The project supports a wide range of Linux kernel versions and architectures, including x86/x86_64 and ARM64.
Security researchers, penetration testers, and developers interested in kernel-level exploits, rootkit development, or Linux security hardening.
Developers choose Diamorphine for its simplicity, compatibility across multiple kernel versions, and practical demonstration of stealth techniques like process hiding and privilege escalation, making it a valuable resource for hands-on security education.
LKM rootkit for Linux Kernels 2.6.x/3.x/4.x/5.x/6.x (x86/x86_64 and ARM64)
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Supports Linux kernels from 2.6.x to 6.x across x86/x86_64 and ARM64 architectures, as confirmed in the README and description, making it versatile for testing on various systems.
Implements core rootkit techniques like process hiding with signal 31 and file concealment via MAGIC_PREFIX, providing practical examples for security research.
Serves as a straightforward, code-focused resource for learning kernel-level rootkit mechanics, with minimal setup and clear signal-based commands outlined in the README.
Offers simple 'make' and 'insmod' steps for loading, as shown in the Install section, reducing barriers for researchers familiar with kernel modules.
The README is sparse, covering only basic commands without detailed explanations, troubleshooting, or safety guidelines, which can hinder deeper understanding.
As a kernel module that manipulates core functions, improper use can lead to crashes or instability, with no built-in error handling or recovery features.
Designed for stealth and exploitation, it may not be suitable for legitimate professional use and could raise compliance issues in regulated environments.