rvbbit-arsenal - Offensive & defensive Linux kernel security resear

项目说明

RVBBIT Arsenal

Offensive & Defensi Kernel Security Research

RVBBIT Arsenal is an experimental Linux kernel security research en built around a simple idea:

> If we understand how a system can be manipulated, we should also study what e that manipulation lea.

The repository brings offensi experiments and defensi work into the same project.

It grew out of the original Project RVBBIT, which began as an educational Linux kernel rootkit proof of concept.

RVBBIT Arsenal takes the next step.

Instead of asking only how kernel-le works, the project also asks:

* What state was modified?
* What disappeared from normal ?
* What artifacts remain?
* Can another source expose the inconsistency?
* What can a defender measure or independently?

The long-term research model is:

> Research only: RVBBIT Arsenal is intended for cybersecurity education, controlled laboratory experiments, malware-analysis research, and defensi work. It is not intended for operational deployment.

---

Why RVBBIT Arsenal exists

Project RVBBIT originally focused on the offensive side of Linux kernel .

The experiments explored techniques such as:

* Direct Kernel Object Manipulation (DKOM);
* syscall interception;
* process and module hiding;
* filesystem manipulation;
* network manipulation;
* persistence behavior;
* interference with selected eBPF-based obser paths.

While de those experiments, another question became more interesting:

> What did the hiding mechanism fail to hide?

That question became the foundation of RVBBIT Arsenal.

The goal is not simply to place a rootkit and an "anti-rootkit" next to each other.

The goal is to study both sides of the same system state.

---

Repository structure

attack/

Contains the offensi side derived from Project RVBBIT.

The code is used to study how kernel-le can alter what normal userspace tools are able to observe.

defense/

Contains R, the defensi side of the project.

R explores detection and integrity- approaches related to the artifacts produced by the offensi.

docs/

Contains longer-form documentation and technical notes describing the research.

---

The research model

RVBBIT Arsenal is organized around the relationship between an offensi and the e it produces.

| Stage | Question |
| ------------------ | ------------------------------------------------------ |
| Technique | What behavior is being tested? |
| Modification | What kernel state or interface changes? |
| gap | What does normal userspace stop seeing? |
| Artifact | What e remains elsewhere? |
| Telemetry | Which independent source can expose it? |
| Detection | How can that inconsistency be identified? |
| Limitation | Where does the detection fail or generate uncertainty? |

This model is more important to the project than any single rootkit technique.

---

Offensi

The offensive side of RVBBIT Arsenal is derived from the original RVBBIT experiments.

Research areas include:

| Area | Research question |
| ------------------------- | -------------------------------------------------------------------------------------- |
| DKOM | What happens when kernel objects or their relationships are manipulated directly? |
| Process hiding | Can process existence differ from process enumeration? |
| Module hiding | What remains observable after normal module enumeration is altered? |
| Syscall interception | How does redirecting kernel interfaces affect userspace ? |
| Filesystem | What happens when directory information is filtered before reaching userspace? |
| Network | Can one networking interface present a different view from another? |
| eBPF interaction | What happens when kernel-level code interferes with selected obser mechanisms? |
| Persistence | Which artifacts are created by attempts to survi or restart? |

These techniques are implemented as research experiments.

They are not presented as novel, uni stealthy, or capable of reliably bypassing current endpoint security products.

---

Defensi: R

R is the defensive side of RVBBIT Arsenal.

It was created after the offensi raised a more useful question:

> If one source of system information can be manipulated, can another source reveal the disagreement?

The current defensive work includes experiments around:

* hidden-process discovery;
* cross-view comparison;
* syscall-table integrity ;
* restoration of altered kernel references;
* persistence-artifact discovery;
* cleanup of artifacts associated with the test en;
* comparison between kernel and userspace obser.

R should not be interpreted as a complete anti-rootkit or endpoint security product.

It is a research prototype used to explore detection ideas against known behavior in the RVBBIT laboratory en.

---

Attack

The relationship between both sides of the project can be represented like this:

The project increasingly focuses on those inconsistencies.

A hidden object does not necessarily stop existing.

A filtered interface does not necessarily remove the underlying state.

A disabled sensor may itself become an observable event.

Those gaps are often where defensi becomes useful.

---

Cross-view detection

One of the main ideas behind the defensive side is cross-view analysis.

Suppose one kernel structure reports one set of processes while an independent structure implies another.

Neither view should automatically be treated as absolute truth.

The interesting signal is the disagreement.

The same idea can be applied to several areas:

This approach is not specific to RVBBIT.

The broader research question is whether multiple partially independent obser can expose manipulation that remains in through a single interface.

---

A note on stealth

RVBBIT Arsenal does not use *stealth* as a synonym for *undetectable*.

The project demonstrates concealment from particular paths or sources.

That distinction matters.

A process can disappear from one enumeration mechanism and still lea somewhere else.

A module can disappear from a standard listing while still occupying memory.

A connection can be filtered from one interface while remaining observable through another part of the networking stack.

For that reason:

> The defensi often begins where the offensi stops.

---

Limitations

RVBBIT Arsenal is a learning and research prototype.

It does not claim to:

* introduce pre unknown Linux rootkit techniques;
* defeat modern EDR products reliably;
* bypass modern hyper integrity mechanisms;
* provide uni compatibility across Linux kernel ;
* represent a production-ready offensi;
* represent a production-ready defensi;
* provide complete co of current Linux kernel threats.

Several offensi intentionally reproduce established approaches because understanding their assumptions and detection opportunities is part of the project.

Likewise, the defensive side is tested primarily against behavior associated with the RVBBIT research en.

A successful detection in this laboratory should not be interpreted as proof that the same mechanism detects every unrelated kernel threat.

---

Why limitations are part of the project

A security experiment is less useful if every failure is hidden.

For RVBBIT Arsenal, limitations are research results too.

If an offensi becomes because of a particular artifact, that tells us something useful.

If a detection generates false positives, that tells us something useful.

If a kernel update breaks an assumption, that tells us something useful.

If two supposedly independent telemetry sources turn out to depend on the same kernel interface, that is especially useful.

The objective is not to make either side look unbeatable.

The objective is to understand where each side breaks.

---

Relationship to Project RVBBIT

The original Project RVBBIT is where the research started.

Its central question was:

> How can kernel-le change what userspace sees?

RVBBIT Arsenal continues from there:

> What e remains when that view can no longer be trusted?

The relationship between the projects is:

The first repository represents the original proof of concept.

Arsenal represents the broader research direction.

---

Independent co and external indexing of RVBBIT research

The original RVBBIT project has been independently examined by cybersecurity researchers outside the repository.

Hackplayers — Spain

Spanish cybersecurity publication Hackplayers published a technical analysis:

RVBBIT: anatomía de un rootkit LKM moderno basado en stealth, DKOM y anti-eBPF

The article discusses the original project's architecture, DKOM behavior, syscall interception, hiding mechanisms, persistence, and interaction with eBPF-based obser.

CSDN — China

A separate Chinese technical article on CSDN analyzed Project RVBBIT:

内核里的“幽灵”：一套Linux Rootkit隐身术完全拆解

The article independently examines several of the project's kernel-le mechanisms and discusses possible defensi.

and Sploitus — Security indexing

RVBBIT Arsenal was also indexed by specialized cybersecurity search and intelligence services.

— RVBBIT Arsenal

Sploitus — RVBBIT Arsenal

The record identifies KitPloit as its source, while the matching KITPLOIT:TOOLS-GITHUB-BUTER-CHKALO identifier used by these entries indicates that they belong to the same external indexing chain rather than representing separate technical analyses.

Their presence is useful as e that RVBBIT Arsenal has entered broader security-tool and /exploit discovery ecosystems, but it should not be presented as an endorsement or independent security review.

Some of these external records preserve an older snapshot of the project and may mention miner or network-worm functionality. Those descriptions do not reflect the current public repository, where potentially harmful functionality has been removed, neutralized, or represented through non-operational research simulations.

LinkedIn — Community sharing

The original Project RVBBIT was also independently shared on LinkedIn by Ya:

Project RVBBIT — LinkedIn post by Ya

The post links directly to the original Project RVBBIT repository. It is not a technical analysis, but it represents another example of the research being discovered and circulated independently outside the author's own channels.

Taken together, the independent technical analysis, community sharing, and external security indexing show different forms of outside interest in the original project. That interest contributed to the decision to continue the research through RVBBIT Arsenal rather than simply expand the rootkit proof of concept.

---

Documentation

Longer-form documentation is a under:

The project documentation is being de around both offensi and defensi.

The intended direction is to document experiments using a consistent format:

This structure will gradually replace broad claims about "attack" and "defense" with reproducible research notes.

---

Research roadmap

The areas I want to explore further include:

* cross-view process detection;
* kernel integrity checking;
* module discrepancies;
* eBPF-based telemetry;
* persistence artifact analysis;
* detection engineering;
* ATT&CK mapping where technically appropriate;
* reproducible laboratory scenarios;
* kernel- compatibility testing;
* false-positi;
* defensi against modified of the offensi.

The long-term objective is for meaningful offensi to ha defensi.

Not:

but:

---

Safety and responsible use

RVBBIT Arsenal is intended for:

* cybersecurity education;
* malware-analysis laboratories;
* controlled Linux kernel experiments;
* authorized security research;
* defensi research.

Use the project only on systems you own, disposable laboratory en, or systems where you ha authorization to perform security testing.

Do not deploy offensi against third-party systems or infrastructure without permission.

---

Feedback

Technical criticism is welcome.

I am particularly interested in feedback related to:

* Linux kernel internals;
* detection methodology;
* incorrect assumptions;
* cross-view analysis;
* eBPF obser;
* kernel- compatibility;
* integrity ;
* false positives;
* reproducibility.

The project is intended to evol testing and criticism rather than through claims of perfect stealth or perfect detection.

---

Author

buter-chkalova

Independent security research focused on Linux kernel internals, offensi, rootkit behavior, and defensi.

RVBBIT research

* Project RVBBIT — original Linux Kernel Rootkit Research PoC
* RVBBIT Arsenal — offensive & defensi kernel security research en

---

License

Released under the MIT License.

See LICENSE for details.

项目信息

开发语言：C

Star 数：16

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Offensive & defensive Linux kernel security research focused on rootkit behavior, observable artifacts and detection.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。