codename: wrong8007

Wrong Boot

A programmable kernel-resident trigger framework for last-resort execution.

Inspired by the USBKill project from 2016, Wrong Boot rethinks the idea as a modular Linux kernel module. Triggers are independent of execution, allowing the same core to support different activation mechanisms while leaving payloads entirely user-defined.

Why it exists

Systems can be seized, inspected, or tampered with in seconds. By then, the opportunity to decide may already be gone.

What remains is the decision you made beforehand.

Wrong Boot exists for those situations. It monitors predefined conditions from within the kernel and executes the response you chose before that moment arrived.

Wrong Boot is intentionally limited. It is not:

malware, notably rootkit (uh doy)
a persistence framework
a remote access tool
command-and-control infrastructure
an evasion or stealth toolkit
software that makes security decisions on your behalf

It does not install itself, communicate externally, escalate privileges, or modify the system outside the scope of its configured execution path. It is a kernel module you compile and load yourself, not a packaged tool.

What it does

The project separates detection, execution policy and payload behavior into independent layers.

Triggers detect conditions,
The core owns execution.

The payload is entirely the operator's responsibility.

This keeps the system predictable, easier to reason about and easier to extend.

Quick start

Load the module so that typing nuke on the console keyboard runs a script:

$ make
$ chmod +x tests/test_exec.sh
$ make load PHRASE="nuke" EXEC="$(realpath tests/test_exec.sh)"

Full build and load steps are on installation guide; every trigger's parameters are documented on activation triggers.

Status

Functionally complete for the three in-tree triggers. Not stress-tested across kernel versions beyond the development targets on x86_64, not packaged for any distribution, not signed for Secure Boot by default, not audited by any third party, no DKMS support yet. See FAQ for practical considerations and the threat model on Security model.