Which rootkit is characterized by its function of adding code and/or replacing some of the operating- system kernel code to obscure a backdoor on a system?

A user-mode rootkit operates in the user space, infecting applications or libraries, making it easier to detect as it does not modify the core OS kernel.

A library-level rootkit is a type of user-mode rootkit that intercepts system calls by modifying dynamic-link libraries, but it doesn't directly alter the OS kernel.

A kernel-level rootkit operates at the highest privilege level within an OS, directly modifying or replacing operating system kernel code to effectively obscure its activities, hide backdoors, and maintain persistent, stealthy control.

A hypervisor-level rootkit runs beneath the operating system as a virtual machine monitor, but the description specifically mentions modifying 'operating-system kernel code,' which is characteristic of a kernel-level rootkit.