trevohack/venom

Venom is a Linux loadable kernel module that intercepts kernel execution paths through ftrace. The principal workflow is: a host process invokes a syscall, ftrace redirects selected kernel symbols to Venom handlers, handlers inspect or alter the request, and permitted operations fall through to the original kernel function. Distinct stages include module initialization, hook dispatch, concealment/protection policy, network filtering, and optional logging. The graph reflects sampled implementations plus README-documented hook families; several unsampled handlers are represented only at their exact tree paths.