m0nad/Diamorphine

Health v2 · maintenance only

Flags: no_releases no_license

Adoption not part of the score

2442 stars · 486 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Diamorphine is a loadable kernel module (LKM) rootkit for Linux kernels 2.6.x through 6.x on x86/x86_64 and ARM64. It demonstrates rootkit techniques such as module invisibility, process and file hiding, and privilege escalation via signals.

Use cases

• study how linux kernel rootkits hide processes and files
• test rootkit detection tools against a real lkm rootkit
• red team training on kernel-level stealth techniques
• security research on syscall hooking in modern kernels
• learn linux kernel module hacking

When to choose

• you need a well-known reference rootkit for detection testing or security research
• you are studying LKM rootkit techniques across many kernel versions including 5.7+ and ARM64

When to avoid

• you need a defensive or monitoring tool - this is offensive research code
• you want something safe for production systems - loading it hides itself and grants root

Facets

library · maturity active

security penetration-testing security penetration-testing operating-systems cli rootkit lkm kernel-module redteam malware-research stealth backdoor linux

Member repositories

For agents

markdown · JSON · MCP: product_card(name="m0nad/Diamorphine")