// the find
jvns/kernel-module-fun
Some fun things you can do with kernel modules (all "bad ideas")
A handful of tiny Linux kernel modules Julia Evans wrote while teaching herself kernel programming: a hello-world module, a packet logger, and a basic rootkit. It's for developers curious about how kernel modules hook into the syscall table and network stack, not for anyone needing a working toolkit.
Each example is small enough to read in one sitting instead of wading through a full driver; the rootkit.c has a companion blog post that walks through the syscall-hooking technique line by line, which is more useful than the code alone; it's upfront that these are 'bad ideas' rather than dressing up a rootkit as a security tool.
Pinned to kernel 3.5.0-18 (Ubuntu 12.04, ~2012) - syscall table write-protection, KPTI, and module signing changes since then mean none of this compiles or loads on a current kernel without real rework; no VM/container setup is documented despite insmod-ing a rootkit being exactly the kind of thing you want isolated; the 2022 push looks like a README/metadata touch, not actual maintenance - there's no indication anyone's kept it building against newer kernels; zero tests or even a sanity check beyond 'dmesg | tail'.