m0nad/Diamorphine
FreeLKM rootkit for Linux Kernels 2.6.x/3.x/4.x/5.x/6.x (x86/x86_64 and ARM64)
FreeFree tier
About m0nad/Diamorphine
Diamorphine is a Loadable Kernel Module (LKM) rootkit for Linux systems, supporting kernels from 2.6.x to 6.x on x86, x86_64, and ARM64 architectures. Designed for penetration testing and red team engagements, it operates with stealth from the moment of loading. Key capabilities include hiding and unhiding any process by sending signal 31, toggling the module's visibility with signal 63, and escalating any user to root using signal 64. Additionally, files and directories prefixed with a configurable MAGIC_PREFIX become invisible. Diamorphine is open-source under a permissive license, provided as a single C source file with a Makefile for easy compilation.
Key Features
Module starts invisible when loaded
Hide/unhide any process by sending signal 31
Signal 63 toggles module visibility (makes it (in)visible)
Signal 64 escalates any user to root
Files/directories starting with MAGIC_PREFIX become invisible
Pros & Cons
Pros
- Stealth by default (module invisible after loading)
- Cross-architecture support (x86, x86_64, ARM64)
- Simple signal-based control for hiding and privilege escalation
- Open source with permissive license
- Lightweight, single C source file with easy compilation
Cons
- Requires root privileges to load and unload the module
- Potential for misuse in malicious activities
- Can be detected by modern security tools (e.g., kernel integrity checkers)
- Limited to Linux systems and specific kernel versions
- No built-in anti-detection against advanced forensic analysis
Best For
Penetration testing and red team exercisesSecurity auditing and vulnerability assessmentEducational research on kernel-level rootkitsUnderstanding Linux kernel module internals
FAQ
How do I install Diamorphine?
Clone the repository, enter the folder, run 'make' to compile, then load the module with 'insmod diamorphine.ko' as root.
How do I make the module visible after loading?
Send signal 63 to any PID: 'kill -63 0'. This toggles the module's visibility.
How do I hide a process?
Send signal 31 to the PID of the process you want to hide: 'kill -31 <PID>'. Sending signal 31 again will unhide it.
How do I become root using Diamorphine?
Send signal 64 to any PID: 'kill -64 <pid>'. The user associated with that PID will be granted root privileges.
What Linux kernel versions are supported?
Diamorphine supports Linux kernels 2.6.x, 3.x, 4.x, 5.x, and 6.x on x86, x86_64, and ARM64 architectures.