amark
=====

Rootkit and detection module (wip) for Linux x86{\_64}, ARM (wip²)
The purpose is not to have a fully functional rootkit, (no hidden file/process/connection),
but a rootkit that hide itself as much as possible.
In parallel, we use some tools [1] to detect our malicious lkm.

[1]: volatility, lime, rkhunter, lynis, ktraq and some personal tool
