Linux_rootkit_wingchun by nu11secur1ty w1ngc#un is a Loadable Kernel Module (LKM) 2. Introduction to Linux Loadable Kernel Modules If you want to add code to a Linux kernel, the most basic way to do that is to add some source files to the kernel source tree and recompile the kernel. In fact, the kernel configuration process consists mainly of choosing which files to include in the kernel to be compiled. So this is a manual method to do this. But you can also add code to the Linux kernel while it is running. A chunk of code that you add in this way is called a loadable kernel module. These modules can do lots of things, but they typically are one of three things: 1) device drivers; 2) filesystem drivers; 3) system calls. The kernel isolates certain functions, including these, especially well so they don't have to be intricately wired into the rest of the kernel. 2.1. Terminology Loadable kernel modules are often called just kernel modules or just modules, but...