COLLECTION 05 / BELOW THE SURFACE

OneRootkit.

What a system shows you.
What the inventory still contains.

ONE
EXPERIMENTAL / v0.1
ORIGINAL MUSEUM INTERFACE / FICTIONAL LINUX HOST
ubuntu-museum / inventory snapshotCOMPLETE VIEW
Fixture records
Visible records
View discrepancy

Reference inventory

ALL FICTIONAL RECORDS

Presented view

UNFILTERED

Records stay intact. Only this page’s displayed list changes.Host connections: 0
INSPECT A RECORD

Select a row

Click an entry in either inventory to inspect the fictional record and its visibility.

WHY THE COMPARISON MATTERS

Absence is not deletion.

A filtered result can make an object appear absent even though it remains in the underlying inventory. This visual model explains that distinction. The left column is an exhibit reference, not a claim that a real compromised system provides a trustworthy second view.

PROJECT NOTES / SOURCE-BASED CONTEXT

An experiment in Vala.

01 / STATUS

Experimental v0.1

The README calls the project an experiment and describes substantial work as unfinished. Its warning about instability belongs to that context; this exhibit does not imply a stable or widely deployed release.

02 / DOCUMENTED BEHAVIOR

Concealed listings

The README lists file and directory hiding by name or group identifier, and process hiding by group identifier. Here, a fixed “illustrated” marker chooses fictional rows so you can compare the two views.

03 / LANGUAGE

Vala → C

The project describes Vala-generated C and bundled minimal runtime headers. The repository credits Mephisto, Aurora, and related research. These are project credits, not evidence of a particular campaign or deployment history.

Repository structure and interface provenance

The rootkit source is organized into hooks, initialization, utilities, and concealment-related components. The repository also includes a bundled Vala dependency and tests. No rootkit GUI was identified in the inspected tree; this comparison interface is an original Shadow Lab visualization.

Repository ↗ · README and credits ↗

Interactive display only. All records are fictional; no rootkit code, build artifacts, system hooks, or installation behavior are included.