system call hook for Linux

Resources About Hooking. For All Platforms. Currently 300+ Tools And 600+ Posts.

Inline syscalls made for MSVC supporting x64 and WOW64

SysWhispers & HellsGate successor, executing protected Indirect & Direct syscalls in EDR protected settings

Rootkit for the blue team. Sophisticated and optimized LKM to detect and prevent malicious activity

Author of Project Adrishya a rootkit which use ftrace mechanism to hook syscall; (write this because God commanded me); work for both x86_64 and arm; CREDIT-(Oleksii Lozovskyi{ilammy})FOUNDER OF FTRACE HOOKING

The lazypoline syscall interposer

This project is no longer maintained. You should check out SledRE (https://github.com/sledre/sledre) which is the continuation of it.

The scalable approach to build secure in-process syscall interposers

Enumerate which window API calls are hooked by an EDR using inline patching technique

LKM Rootkit targeting Linux v6.x. Security project showcasing syscall hooking, process/file hiding, and privilege escalation via PTE write-protect bypass

Kernel module demos of syscall hooking, livepatch, and per-task stack transition checks (arm64)

RKHUNTER LIVE is an immersive, interactive training platform for learning rootkit detection and malware forensics on Linux systems. Featuring a fully simulated rkhunter, chkrootkit, AIDE, and Lynis environment, this platform allows security professionals and students to practice identifying kernel rootkits, rootkits, userland rootkits🕵🏿.

fsh, a library provides a convenient and simple way to hook system calls using ftrace

It's a simple rootkit and provide the following functions: (1) hide/unhide module (2) masquerade process name (3) hook/unhook syscall

Danger! It is crash your system

OS Lab - Experiment08

Windows 11 compatible NtUserXxx syscall hook inside Win32k with PoC implementation and Usermode framework in both of C and C++