Clean Indirect Syscalls with Syscall Tampering.
Linux Test Project (mailing list: https://lists.linux.it/listinfo/ltp)
Patching and hooking the Linux kernel with only a stripped Linux kernel image.
chroot, mount --bind, and binfmt_misc without privilege/setup for Linux
An embedded project using leaked Windows XP OS kernel + Linux userland (Syscall shim + Musl + Busybox + Xfce desktop)
Stealthy Linux Kernel Rootkit