Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to learn more about rootkits and was hoping to take one and let it loose in a virtual environment.

Does anyone know of a rootkit currently available that I can safely use to do this, and doesn't do too much?

share|improve this question

migrated from May 11 '11 at 6:34

This question came from our site for professional and enthusiast programmers.

A simple google will show you a wide range of rootkits, however, I would not consider any rootkit safe unless I had reviewed all the code personally.

Certainly running it in a virtualised environment with no connection to the outside world is the right thing to do so that if it does have functionality you aren't aware of the risk is minimised.

My advice - first read some of the excellent rootkit analysis material from Symantec, McAfee, Hoglund, Russinovich or ESET. They look at how various rootkits work, and also name ones which may be useful to you.

share|improve this answer

Look for LRK5 or adore-ng. They are old but they help to understand some principles of user-mode (LRK5) and kernel-mode (adore-ng) rootkits. Sources: LRK5, adore-ng. prack magazine has some interesting articles about this topic as well.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.