I linked a ton of git repos in another comment here, some of them have very readable code. LD_PRELOAD rootkits are super easy to understand. Phrack has tons of

I linked a ton of git repos in another comment here, some of them have very readable code. LD_PRELOAD rootkits are super easy to understand. Phrack has tons of relevant content, Blackhatacademy has some (https://nets.ec/LD_Preload https://nets.ec/LD_Preload) A quick google search also found this simple walkthrough https://fluxius.handgrep.se/2011/10/31/the-magic-of-ld_preload-for-userland-rootkits/ https://fluxius.handgrep.se/2011/10/31/the-magic-of-ld_prelo...