sysprog21 / lkm-hidden

A Linux kernel module which hides itself

lkm-hidden

A Linux kernel module which hides itself.

Usage

Build this kernel module:

make

Load lkm-hidden:

sudo insmod hidden.ko

Then, you can NOT figure out the kernel module.

cat /proc/modules | grep hidden
ls -l /sys/module/ | grep hidden

License

lkm-hidden is released under the GNU GPL. Use of this source code is governed by a copyleft-style license that can be found in the LICENSE file.

lkm-hidden's Issues

/proc/sys/kernel/tainted

If you load this module, /proc/sys/kernel/tainted will have bits masks set and you will get a pretty message in dmesg:

[   62.037165] example: loading out-of-tree module taints kernel.
[   62.037234] example: module verification failed: signature and/or required key missing - tainting kernel

Whilst it's not a complete giveaway.

1. The module (example) is visible above.
2. Since the tainted module is hidden, the tainted flag indicates that a module is potentially hiding.