rootkit 开源项目推荐（425 个）

mrexodia /TitanHide

Hiding kernel-driver for x86/x64.

Idov31 /Nidhogg

Windows rootkit for Intel x64 with 25+ features, demonstrating rootkit techniques compatible with all Windows 10 and Windows 11 versions.

m0nad /Diamorphine

LKM rootkit for Linux Kernels 2.6.x-7.x (x86/x86_64 and ARM/ARM64)

bytecode77 /r77-rootkit

Fileless ring 3 rootkit with installer and persistence that hides processes, files, network connections, etc.

milabs /awesome-linux-rootkits

awesome-linux-rootkits

ExpLife0011 /awesome-windows-kernel-security-development

windows kernel security development

JKornev /hidden

🇺🇦 Windows driver with usermode interface which can hide processes, file-system and registry objects, protect processes and etc

xl7dev /WebShell

Webshell && Backdoor Collection

h3xduck /TripleCross

A Linux eBPF rootkit with a backdoor, C2, library injection, execution hijacking, persistence and stealth capabilities.

MatheuZSecurity /Singularity

隐蔽的 Linux 内核 rootkit。

jm33-m0 /emp3r0r

Linux-first multi-operator C2 built to stay quiet and keep working. Self-healing mesh with assisted discovery, in-memory execution with encrypted storage, scriptable agents, cross-platform BOFs, SOCKS5 pivoting, and a modular C agent delivered by a sleep-masking stager.

skyw4tch3r /RootKits-List-Download

This is the list of all rootkits found so far on github and other sites.

ZeroMemoryEx /Chaos-Rootkit

现在你看到我，现在你看不到

mempodippy /vlany

Linux LD_PRELOAD rootkit（x86 和 x86_64 架构）

XaFF-XaFF /Cronos-Rootkit

Cronos is Windows 10/11 x64 ring 0 rootkit. Cronos is able to hide processes, protect and elevate them with token manipulation.

Cr4sh /s6_pcie_microblaze

PCI Express DIY hacking toolkit for Xilinx SP605. This repository is also home of Hyper-V Backdoor and Boot Backdoor, check readme for links and info

Gui774ume /ebpfkit

ebpfkit is a rootkit powered by eBPF

nurupo /rootkit

Linux rootkit for Ubuntu 16.04 and 10.04 (Linux Kernels 4.4.0 and 2.6.32), both i386 and amd64

sudoskys /Root

？什么你说Root？我不到啊 | 致力于编写全面详细的Root教程文档 | 刷机 | 安卓

screetsec /Vegile

这个工具会帮你设置后门/rootkit，当后门已经设置好时，它会隐藏你的特殊进程，限制Metasploit中的会话，并且透明。即使杀死了，它也会再次运行。总会有一个程序，同时运行另一个进程，所以我们可以假设这个程序像攻壳机动队一样不可阻挡