A curated compilation of extensive resources dedicated to bootkit and rootkit development.

A ring0 Loadable Kernel Module (Linux) for latest kernels 6.x

Windows Kernel Rootkit

Ftrace Based Linux Loadable Kernel Module Rootkit for Linux Kernel 5.x up to linux kernel 6.2 on x86_64, hides files, hides process, hides bind shell & reverse shell port, privilege escalation, cleans up logs and bash history during installation - developed by Antonius in 2023 manually

Kernel-space x86_64 Linux rootkit leveraging kprobes and ftrace for syscall hooking (hiding entries and reverse shell backdoor)

Starter pack for learning how to develop Kernel-Mode rootkits: basic proof-of-concepts, development environment configuration, and step-by-step resources to begin coding low-level rootkit components from scratch.

Linux Loadable Kernel Module Rootkit for Linux Kernel 5.x up to linux kernel 6.8 on x86_64, hides files, hides process, hides bind shell & reverse shell port, privilege escalation, cleans up logs and bash history during installation

Rootkit for Windows 32-bit

Bypassing PatchGuard at Runtime - Windows 11 25H2

RKHUNTER LIVE is an immersive, interactive training platform for learning rootkit detection and malware forensics on Linux systems. Featuring a fully simulated rkhunter, chkrootkit, AIDE, and Lynis environment, this platform allows security professionals and students to practice identifying kernel rootkits, rootkits, userland rootkits🕵🏿.

Static-Analysis notes for the Android ARM64 kernel rootkit (mem_tool driver) -- IDA Pro walkthrough, ioctl map, stealth primitives, self-extracting loader dissection, and a from-source audit rebuild. Security research only -- not affiliated with the original author.