Which rootkit is characterized by its function of adding code and/or replacing some of the operating- system kernel code to obscure a backdoor on a system?

User-mode rootkits operate in user space by hooking user-mode APIs and do not directly modify kernel code.

Library-level rootkits intercept calls by replacing or patching shared libraries (such as DLLs or shared objects), not kernel code itself.

Kernel-level rootkits operate by injecting code into or replacing portions of the operating system kernel, giving them the highest level of privilege within the OS. Because they run in kernel space, they can intercept and manipulate system calls, hide processes, files, and network connections, and obscure backdoors from security tools. This direct manipulation of kernel code is the defining characteristic that distinguishes them from rootkits operating at higher abstraction layers.

Hypervisor-level rootkits install a thin virtualization layer beneath the OS to control it, rather than modifying kernel code within the OS.