jvns/kernel-module-fun — explained in plain English
Analysis updated 2026-08-08 · repo last pushed 2022-04-13
Learn how Linux kernel modules are written and loaded into a running system.
Study how rootkits hide themselves and maintain privileged access on a system.
Experiment with intercepting network packets at the kernel level.
Understand low-level system programming concepts through hands-on examples.
| jvns/kernel-module-fun | v12-security/pocs | torvalds/libdc-for-dirk | |
|---|---|---|---|
| Stars | 438 | 486 | 389 |
| Language | C | C | C |
| Last pushed | 2022-04-13 | — | 2024-12-26 |
| Maintenance | Dormant | — | Stale |
| Setup difficulty | hard | hard | moderate |
| Complexity | 4/5 | 4/5 | 3/5 |
| Audience | developer | researcher | developer |
Figures from each repo's GitHub metadata at analysis time.
Requires a Linux environment with kernel headers and build tools, tested only on kernel 3.5 series with uncertain compatibility on newer kernels.
kernel-module-fun is a small collection of experimental Linux programs created by someone learning how kernel modules work. Kernel modules are pieces of code that can be inserted directly into the core of a running Linux system, giving them deep access to how the computer operates at a fundamental level. This project is essentially a learning exercise, with the creator openly describing everything in it as a "bad idea." The repository contains three main pieces of code. The first is a basic "hello world" module that simply prints a greeting message. The second logs information every time the computer receives a network packet, and could be modified to drop packets. The third is described as a simple rootkit, which is software designed to hide itself and maintain privileged access to a system. The creator wrote a blog post explaining how the rootkit works in more detail. This project would appeal to people curious about how operating systems work under the hood. A student learning about Linux internals, a security researcher studying how rootkits operate, or a developer exploring low-level system programming might find it interesting. It is meant for experimentation and understanding, not for production use. The code is written in C and was tested on an older Linux kernel from the 3.5 series. The creator notes that it probably will not work on much older kernels and is unsure about newer ones. While she says the code is unlikely to cause lasting damage, she also does not guarantee anything. Running code at the kernel level carries real risk because it operates with the highest privileges on the system, and mistakes can crash the entire computer. The README is straightforward and honest about its limitations. It does not go into deep technical detail about how each module works, but it provides enough context for someone to understand the purpose. The accompanying blog post offers more explanation for the rootkit portion.
A collection of experimental C programs that demonstrate how Linux kernel modules work, including a hello world example, a network packet logger, and a simple rootkit. Created as a learning exercise, not for production use.
Mainly C. The stack also includes C, Linux kernel modules.
Dormant — no commits in 2+ years (last push 2022-04-13).
No license information is provided in the repository.
Setup difficulty is rated hard, with roughly 1h+ to a first successful run.
Mainly developer.
This repo across BitVibe Labs
Don't trust strangers blindly. Verify against the repo.