Skip to content

README.EN.md

Latest commit

 

History

History
124 lines (85 loc) · 5.3 KB

README.EN.md

File metadata and controls

124 lines (85 loc) · 5.3 KB
Raw

Kernel Module Examples

An educational repository of sample code and skeletons for building Kernel Modules / Drivers across platforms.

Language: English | Bahasa Indonesia

Table of Contents

About

This repository collects sample code and skeletons for building Kernel Modules across several platforms: Linux, FreeBSD, Solaris, and Windows.

Every sample ships with build, load, and unload instructions — just follow the header comment in each source file or the README in its directory.

This repository is an initiative of the Reversing.ID community to learn Kernel Module development. Reversing.ID is not affiliated with any platform vendor; the repository's sole purpose is education.

What is a Kernel Module?

A Kernel Module is a piece of code that extends or enriches the functionality of an operating system's kernel, without requiring the kernel to be rebuilt every time a change happens. Most operating systems support this concept under their own name, for example:

  • Kernel Loadable module (kld) for FreeBSD
  • Kernel Extension (kext) for MacOS
  • Loadable Kernel Module (lkm) for Linux and Solaris

A Kernel Module is often referred to as a driver or device driver. While many kernel modules are created to implement an interface between the kernel and a device, that term isn't fully accurate — a kernel module can also implement a kernel-side feature with no relation to a physical device at all (for example, syscall hooking).

Repository Structure

KernelModule-Examples/
├── linux/                    # Linux Loadable Kernel Module (LKM)
│   ├── basics/                # skeleton, module params, memory, syscall hook, kernel thread
│   ├── drivers/
│   │   ├── char/               # character device driver
│   │   └── block/               # block device driver
│   └── payload/                # rootkit-style payload (give-root, hide-file/module/process)
│
├── bsd/                       # FreeBSD Kernel Loadable (KLD)
│   ├── basics/                 # skeleton, memory, syscall hook
│   └── drivers/char/            # character device driver
│
├── solaris/                   # Solaris Loadable Kernel Module (LKM)
│   └── basics/                 # skeleton, memory, syscall hook
│
├── windows/                   # Windows Kernel-Mode Driver Framework (KMDF)
│   └── kmdf/0.basic/            # skeleton, hello
│
├── README.md / README.EN.md   # This documentation
├── CONTRIBUTING.md / .EN.md   # Contribution guide
└── .gitignore

Every sample lives in its own directory containing code.c (or code.cpp) plus the Makefile/project file needed to compile it.

Contents

Platform Term Examples Build Tool
linux/ Loadable Kernel Module (LKM) 17 make (kbuild)
bsd/ Kernel Loadable (KLD) 7 make (bsd.kmod.mk)
solaris/ Loadable Kernel Module (LKM) 4 make (manual gcc/ld rules)
windows/ Kernel-Mode Driver Framework (KMDF) 2 msbuild / Visual Studio

See each platform directory's README for the full example list, concept explanations, and environment setup.

Quick Start

1. Start Here

2. Pick a Platform

3. Set Up the Build Environment

Each platform needs a different toolchain (compiler, kernel headers, WDK, etc). Follow _preparation.EN.md in your chosen platform directory before building.

4. Pick an Example and Build

Every example directory contains:

  • code.c / code.cpp — source code with build/load/unload instructions in the header comment.
  • Makefile (or a project file for Windows) — run make (or msbuild) in that directory.

Contributing

This is an open project. You can contribute code for a platform not yet covered, add new examples, or improve existing ones.

Read CONTRIBUTING.EN.md for the full guide on naming conventions, the template for new examples, and the pull request process.

You can also:

  • email pengurus [at] reversing.id
  • reach out on telegram @ReversingID

Disclaimer

This repository exists for educational purposes. Some examples (particularly under linux/payload/) demonstrate techniques commonly used by rootkits (syscall hooking, hiding processes/files/modules, privilege escalation) — written purely to teach kernel-level programming and reverse engineering concepts, not for misuse against systems you don't own or don't have permission to test. Users are responsible for how they use the code in this repository and must comply with the laws applicable in their jurisdiction.