If you are building a lab or a tool for this, consider integrating . It allows you to run sandboxed programs in the kernel without changing kernel source code, making it the modern standard for observing and blocking rootkit-like behaviors in real-time.
Applicants must pass a medical examination to ensure fitness to drive. Components of the BDVL Test bdvl test