How matheuzsecurity/singularity works
Singularity is a Linux kernel-module rootkit whose main runtime flow initializes stealth and evasion hooks; users trigger process concealment or privilege changes with signals, while a helper script sends the documented ICMP trigger. The graph includes the principal concealment stages and documented anti-detection branches. The sampled initializer shows which modules it initializes, but most module internals were not excerpted, so their interconnections are omitted rather than inferred.
Main entry points: main.c Module Lifecycle · bpf_hook.c BPF Event Filtering · trigger.py ICMP Trigger Client · trace.c Process Hiding
Components 24
Kernel Runtime
- Module Lifecycle
main.c - Ftrace Hooking
ftrace/ftrace_helper.c
Stealth Controls
- Hidden PID State
modules/hidden_pids.c - Process Hiding
modules/trace.c - Directory Hiding
modules/hiding_directory.c - Path Metadata Hiding
modules/hiding_stat.c - Hidden Path Blocking
modules/hiding_chdir.c - Link Hiding
modules/hiding_readlink.c - Connection Hiding
modules/hiding_tcp.c - Module Self-Hiding
modules/hide_module.c
Detection Evasion
- Log Filtering
modules/clear_taint_dmesg.c - I/O Filtering
modules/hooks_write.c - BPF Event Filtering
modules/bpf_hook.c - Audit Filtering
modules/audit.c - Hook Protection
modules/selfdefense.c - LKRG Bypass
modules/lkrg_bypass.c - Taint Normalization
modules/reset_tainted.c - TaskStats Filtering
modules/task.c - Sysrq Hook
modules/sysrq_hook.c
Access Triggers
- Signal Privilege
modules/become_root.c - ICMP Shell Trigger
modules/icmp.c - ICMP Trigger Client
scripts/trigger.py
Other components
- Local Operator
- Remote Operator
Connections 23
- Module Lifecycle → LKRG Bypass: initializes first
main.c - Module Lifecycle → Hook Protection: initializes
main.c - Module Lifecycle → Taint Normalization: initializes
main.c - Module Lifecycle → Signal Privilege: initializes
main.c - Module Lifecycle → Directory Hiding: initializes
main.c - Module Lifecycle → Path Metadata Hiding: initializes
main.c - Module Lifecycle → Connection Hiding: initializes
main.c - Module Lifecycle → Log Filtering: initializes
main.c - Module Lifecycle → I/O Filtering: initializes
main.c - Module Lifecycle → Hidden Path Blocking: initializes
main.c - Module Lifecycle → Link Hiding: initializes
main.c - Module Lifecycle → BPF Event Filtering: initializes
main.c - Module Lifecycle → ICMP Shell Trigger: initializes
main.c - Module Lifecycle → Process Hiding: initializes
main.c - Module Lifecycle → Audit Filtering: initializes
main.c - Module Lifecycle → TaskStats Filtering: initializes
main.c - Module Lifecycle → Sysrq Hook: initializes
main.c - Module Lifecycle → Module Self-Hiding: hides module
main.c - Local Operator → Signal Privilege: sends signal
- Local Operator → Process Hiding: marks process
- Remote Operator → ICMP Trigger Client: requests trigger
- ICMP Trigger Client → ICMP Shell Trigger: sends ICMP
- BPF Event Filtering → Hidden PID State: checks hidden PIDs
modules/bpf_hook.c