Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CrowArmor — Linux kernel security driver using LSM to harden the system, monitor and restore syscall table integrity, and protect CPU control registers against tampering. | Kitploit
Tools/GitHubGitHub/gmh5225/crowarmor
Defensive ToolsIntrusion Detection
GitHubgmh5225/crowarmor

CrowArmor

Linux kernel security driver using LSM to harden the system, monitor and restore syscall table integrity, and protect CPU control registers against tampering.

View Repository
2 years agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CrowArmor : Linux Driver

CrowArmor

What is CrowArmor ?

CrowArmor is a driver for Linux aimed at system security, we use LSM interfaces to improve kernel security, providing support for MalDec-EDR, code documentation and how to proceed with installation Documentation

Development Process

The standard practice is to have the latest stable production version available for customers in the main and tagged branch. The test branch serves as a mirror of the development branch, subjecting it to a battery of tests and quality assurance (QA) processes. Meanwhile, the development (dev) branch is dedicated to ongoing project development, enhancements, and adjustments.

root@kitploit:~
                +-----------+
                | feature1  |
                +-----------+
                     |
                +-----------+
                | feature3  |
                +-----------+
                     |
                +-----------+
                | feature2  |
                +-----------+
                     |
                +-----------+      +-----------+      +-----------+
                |    dev    | ---> |    test   | ---> |   main    |
                +-----------+      +-----------+      +-----------+
                                                            |
                                                +--------------------------+
                                                |            |             |
                                            +-----+      +-----+       +-----+
                                            |1.0.0|      |2.0.0|       | ... |
                                            +-----+      +-----+       +-----+

Testing

You need to test all components of MalDec-EDR, if possible detail the task of the components you tested, which paths you took and how we can perform the tests, if possible create a script of how the tests for your task work, more than 1 developer can carry out the review.

Automated Testing

Every modification to the code, no matter how small, should ideally be accompanied by thorough unit tests. This practice is crucial for detecting potential errors introduced by other developers. The presence of unit tests serves as a safeguard, ensuring that any unintended changes are promptly identified and addressed.

Manual Quality Assurance (QA) Testing

Changes should be tested by somebody other than the developer who wrote the code. This is especially important for large or high-risk changes. It is useful to add a test plan to the pull request description if testing the changes is not straightforward.

Features

  • Communicates with MalDec EDR
  • Modifies the Syscall Table and hooks it
  • Monitors if the Syscall Table has been modified
  • Restores the Syscall if it has been modified by an unknown driver
  • Monitors the CPU Control Registers and restores them if they are modified

Tests carried out

  • Distro Debian-Based
    • Ubuntu
    • Debian
  • Distro Arch-Based
    • Arch Linux
    • Artix
  • Kernel Version 6.0.0
    • 6.8.0-35-generic
    • 6.0.0-060000
  • Kernel Version 5.0.0
    • 5.0.5-050005-generic
  • Kernel Version 4.0.0
Download Tool