Kernel Module — API & Reference

This reference describes the important internals, module parameters and public behaviors of the epirootkit kernel module located in module-creation/.

Module parameters

Parameter	Type	Notes
ip	char *	Target C2 IPv4 address (module parameter, default 127.0.0.1). Set at load time via module_param.
port	int	Target C2 port (default 4242).
password_hash	char *	SHA-256 hex digest (64 chars) expected for authentication.
debug_mode	bool	Controls conditional kernel logging (via DEBUG_LOG macros).

These parameters are declared with module_param and are read-only at runtime (permission 0400). Provide them to insmod or the provided install.sh helper.

Key source files and symbols

• module.c — module entry/exit: epirootkit_init, epirootkit_exit, kthread creation.
• utils/connection.c — connection_thread(void *data): main network worker. Responsibilities:
  • Resolve ip and port and attempt an outbound TCP connection.
  • Send an initial greeting and wait for a 64-hex SHA-256 digest for authentication.
  • Use kernel_recvmsg with MSG_DONTWAIT for non-blocking reads.
  • Call execute_command on received authenticated commands.
  • Uses rot64_encrypt / rot64_decrypt to obfuscate wire data.
• utils/check-password.c — check_password(const char *, size_t): performs constant-time comparison of the 64-byte received hash with password_hash.
• utils/exec.c — execute_command(struct socket *, char *): runs shell commands via call_usermodehelper, captures /tmp/.wlkom_out and sends ROT64-encoded output back over the socket.
• utils/elevate-perms.c — procfs interface: writing the correct SHA-256 hash to /proc/epirootkit may escalate the writer's credentials to root (uses prepare_kernel_cred / commit_creds).

Build & Install

From module-creation/:

make
sudo ./install.sh install <ip> <port> <password> <debug true|false>

The install.sh helper computes the SHA-256 of the provided password and inserts the module with the password_hash parameter.

Doxygen

There is a Doxyfile in the module-creation/ directory. You can generate a C reference with Doxygen if you want HTML-level API output for internal symbols.

Notes & Caveats

• The module runs a persistent kernel thread and performs network I/O from kernel space — this is inherently risky and intended only for controlled, educational environments.
• rot64 is obfuscation only and should not be treated as cryptographic protection.
• Always test and load the module in an isolated VM.