Features

rkcheck provides the tool name rkscanmal that can:

1. Scan files
2. Scan process's memory
3. Find user-land rootkit's library using function's address comparison

Developed as "as effective as possible" in mind, rkscanmal engine has features:

1. Support both Yara signatures (either cleartext or compiled rules) and ClamAV signatures.
2. Collect various information of a running process (from ProcFS) so scan a process is not limited to string scan, but can perform more heuristic detection like reverse shell, thread masquerading or self delete malware

Feature table

Feature	Engine
File parser, unpack, decompression	LibClamAV
File scan	LibClamAV, LibYara
Memory Scan	LibClamAV (fully support Clam's signatures), LibYara
Heuristic process check	LibYara
Rule syntax, False positives, False negatives	Yara's CI
User-land rootkit detection	Custom