gitwtfhub

wtf is kernel-module-fun?

jvns/kernel-module-fun — explained in plain English

Analysis updated 2026-08-08 · repo last pushed 2022-04-13

438CAudience · developerComplexity · 4/5DormantSetup · hard

TL;DR

A collection of experimental C programs that demonstrate how Linux kernel modules work, including a hello world example, a network packet logger, and a simple rootkit. Created as a learning exercise, not for production use.

Mindmap

mindmap
  root((repo))
    What it does
      Hello world module
      Network packet logger
      Simple rootkit demo
    Tech stack
      C language
      Linux kernel modules
      Kernel 3.5 series
    Use cases
      Learn OS internals
      Study rootkit behavior
      Explore system programming
    Audience
      Curious students
      Security researchers
      Low-level developers
    Risks
      Can crash computer
      Runs at highest privileges
      Not for production

Code map

Detail Auto

An interactive map of this repo's files and how they connect — its source is parsed live in your browser. Click Visualize to build it.

filefunction / class

Why would anyone build with this?

REASON 1

Learn how Linux kernel modules are written and loaded into a running system.

REASON 2

Study how rootkits hide themselves and maintain privileged access on a system.

REASON 3

Experiment with intercepting network packets at the kernel level.

REASON 4

Understand low-level system programming concepts through hands-on examples.

What's in the stack?

CLinux kernel modules

How it stacks up

jvns/kernel-module-funv12-security/pocstorvalds/libdc-for-dirk
Stars438486389
LanguageCCC
Last pushed2022-04-132024-12-26
MaintenanceDormantStale
Setup difficultyhardhardmoderate
Complexity4/54/53/5
Audiencedeveloperresearcherdeveloper

Figures from each repo's GitHub metadata at analysis time.

How do you spin it up?

Difficulty · hard Time to first run · 1h+

Requires a Linux environment with kernel headers and build tools, tested only on kernel 3.5 series with uncertain compatibility on newer kernels.

No license information is provided in the repository.

Wtf does this do

kernel-module-fun is a small collection of experimental Linux programs created by someone learning how kernel modules work. Kernel modules are pieces of code that can be inserted directly into the core of a running Linux system, giving them deep access to how the computer operates at a fundamental level. This project is essentially a learning exercise, with the creator openly describing everything in it as a "bad idea." The repository contains three main pieces of code. The first is a basic "hello world" module that simply prints a greeting message. The second logs information every time the computer receives a network packet, and could be modified to drop packets. The third is described as a simple rootkit, which is software designed to hide itself and maintain privileged access to a system. The creator wrote a blog post explaining how the rootkit works in more detail. This project would appeal to people curious about how operating systems work under the hood. A student learning about Linux internals, a security researcher studying how rootkits operate, or a developer exploring low-level system programming might find it interesting. It is meant for experimentation and understanding, not for production use. The code is written in C and was tested on an older Linux kernel from the 3.5 series. The creator notes that it probably will not work on much older kernels and is unsure about newer ones. While she says the code is unlikely to cause lasting damage, she also does not guarantee anything. Running code at the kernel level carries real risk because it operates with the highest privileges on the system, and mistakes can crash the entire computer. The README is straightforward and honest about its limitations. It does not go into deep technical detail about how each module works, but it provides enough context for someone to understand the purpose. The accompanying blog post offers more explanation for the rootkit portion.

Yoink these prompts

Prompt 1
Help me understand how Linux kernel modules work and what happens when you insert one into a running system, using this repo's hello world module as an example.
Prompt 2
Walk me through how the network packet logger in this repo intercepts packets at the kernel level and how I could modify it to drop specific packets.
Prompt 3
Explain how the simple rootkit in this repo hides itself and maintains privileged access, and what makes kernel-level rootkits dangerous.
Prompt 4
I want to write my own basic Linux kernel module in C that prints a message when loaded and unloaded. Help me set up the development environment and write the code.

Frequently asked questions

wtf is kernel-module-fun?

A collection of experimental C programs that demonstrate how Linux kernel modules work, including a hello world example, a network packet logger, and a simple rootkit. Created as a learning exercise, not for production use.

What language is kernel-module-fun written in?

Mainly C. The stack also includes C, Linux kernel modules.

Is kernel-module-fun actively maintained?

Dormant — no commits in 2+ years (last push 2022-04-13).

What license does kernel-module-fun use?

No license information is provided in the repository.

How hard is kernel-module-fun to set up?

Setup difficulty is rated hard, with roughly 1h+ to a first successful run.

Who is kernel-module-fun for?

Mainly developer.

View the repo → Decode another repo

This repo across BitVibe Labs

Don't trust strangers blindly. Verify against the repo.