Write your own rootkit. Hook __*stat{,64}, __*statat{,64}, access, *open{,64}, *dir{,64} *statvfs{,64}, unlink{,at}, etc., to hide your rootkit and other files. Hook *execve{,64}, execv, execl, and the rest of the exec family, system, ptrace, etc., to monitor debuggers and similar "watchdog" processes. Unload the shared library from memory, and map it back into shared memory when the "watchdog" process dies. Hook dlsym, dlvsym, dlopen, etc., to hide the addresses of the symbols which represent your interposed functions by returning the addresses of the real symbols in /lib/libc.so, /lib/libdl.so, etc. Write a little LKM (Linux Kernel Module) that hides the memory mappings from /proc/pid/maps also. Change the default preload path (/etc/ld.so.preload) by patching the dynamic linker. Preserve a false version. This beats rkhunter and chkrootkit easily. There are many things you can do in order to evade detection. These are some simple things you can do to get started. People think userland rootkits are weak, but they just don't know how to properly evade detection. They have the advantage of being mostly kernel-independent also. You can always write a kernel-land rootkit using LKMs, though.
![[Image: 8Yoto.png]](https://i.imgur.com/8Yoto.png)