kjackal | Linux Rootkit Scanner

kjackal is a C library. kjackal has no bugs, it has no vulnerabilities and it has low support. You can download it from GitHub.

In no situation will we be liable for any loss or damage including without limitation, indirect or consequential loss or damage, or any loss or damage whatsoever arising from loss of data or profits arising out of, or in connection with, the use of the data in this repository. This is a kernel module so like any other kernel module things can go bad. It will NOT destroy any data or corrupt your hard drive. At worst, you'll get a kernel panic and you'll have to reboot. If this happens, PLEASE report it :). Feel free to check the code, there is NO hidden backdoors or any shenanigans to install any undesired software on your computer. Kjackal is a one time Linux kernel module rootkit scanner. It is not a rootkit AV or any IPS bimbo-blabla system. The purpose of kjackal is to quickly scan the Linux kernel for rootkit(s). So commonly, a kernel module rootkit, once loaded, will hijack the syscall table, the proc fileystem (to hide itself) and TCP4 operations to hide backdoors' port.