jafarlihi/modreveal

Utility to find hidden Linux kernel modules

(This project is currently unmaintained. It might still work on some Arch Linux but I have observed obvious issues when using a different laptop but don't have time to fix it.)

modreveal

modreveal is a small utility that prints the names of hidden LKMs if any exists.

Usage

make
sudo ./modreveal

Notes

• To test the utility, you can use the Diamorphine rootkit (https://github.com/m0nad/Diamorphine).
• The author runs Arch Linux LTS kernel, so it is only guaranteed to work on Arch Linux LTS kernel. It will most likely work with your kernel too unless you are running something ancient or really new that breaks something.

modreveal's Issues

Rework userspace modreveal.c

Free resources properly.
Adjust buffer sizes.
Load/unload the module programatically.
Dynamically-grow the buffers?

My some questions about how it works and more

Hello! I want to thank you for very cool and useful module to detect hidden kernel modules. I'm making a project to scan malware and rootkit on Linux (the scope is to replace rkhunter and chkrootkit which mostly use absolute file and dir paths check). I would like to reuse your code in my project for the LKM modules (which can't be trusted by user's land applications). I have some questions:

1. I didn't do kernel module programming. And readme didn't have explaination so I would like to ask to understand the method this module uses. Is this some kind of check kernel's symbols and compare to find hidden modules?
2. Let say that attacker added the module to the system. Is there any possible way to find the location of the file?
3. I am thinking about a possible way to unload the rootkit's module and possibly allow a scanner (I'm using Yara) to scan with rules / signatures. Do you think it can be done, considering rootkit's module blocks applications from reading the module file to hide itself.

Add other scanning techniques