I found this small rootkit source code implemented as a Linux kernel module.
Basically, as you can see, it changes the
file_operations structure from the file inode and overwrite the
readdir function to hide itself from
In that case, how would be possible to detect this rootkit?