RVBBIT: What I Learned Building a Linux Kernel Rootkit PoC — and Why I Ended Up Studying Detection
I didn't start RVBBIT with the idea of building a security framework. It was much simpler than that. I wanted to understand Linux rootkits beyond reading about them. I had been studying techniques such as syscall hooking, DKOM, process hiding and kernel module hiding separately, and at some point I realized that reading another explanation wasn't going to answer the questions I had. I wanted to…
The author didn't initially set out to build a security framework with RVBBIT. Their primary motivation was to gain a deeper understanding of Linux rootkits by going beyond reading about them and actually implementing various techniques. They had been studying individual methods like syscall hooking, DKOM, process and kernel module hiding separately, but wanted to see how they interacted when combined in one project.
The first version of RVBBIT was an educational Linux kernel rootkit proof of concept. While the individual techniques were not novel, the project became interesting when the author placed multiple techniques together and observed their interactions, where they broke, and what was hidden. The author started to think in terms of which view of a system component they were actually modifying, rather than how to hide a specific element.
RVBBIT covered a range of experiments including process hiding, DKOM, kernel module hiding, syscall interception, filesystem visibility, TCP connection visibility, eBPF-related mechanisms, and persistence. Initially, the author focused on implementation questions like whether a process could disappear from enumeration or a module vanish from administrator view. However, they eventually noticed that these techniques all shared a common thread - they changed how certain elements were observed.
The author realized that hidden processes are still processes, they just changed how they were observed. They applied this understanding to other techniques, concluding that while each method existed before, combining them provided new insights. The project was more about studying existing ideas together rather than introducing new rootkit primitives.
The author appreciated that other researchers independently analyzed RVBBIT, seeing it as a case study of existing techniques interacting. This external feedback was more valuable than additional recognition on GitHub, as it highlighted which aspects of the project were understandable and where attention could be drawn. The experience reinforced the idea that studying techniques separately can obscure their relationships and that combining them offers a more practical perspective.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — it may contain errors, so check the original before relying on it.
