Which of the following rootkits adds additional code or replaces portions of an operating system, including both the kernel and associated device drivers?

A hypervisor rootkit installs itself below the operating system as a malicious hypervisor, virtualizing the existing OS rather than modifying kernel code or device drivers.

A boot loader rootkit infects the master boot record or volume boot record to load before the OS, not by replacing kernel or driver code after the OS is running.

A kernel level rootkit adds malicious code directly into the operating system kernel or replaces portions of it and its device drivers, operating at ring 0 with the highest privilege level. This allows it to intercept and manipulate system calls, making it extremely difficult to detect because it subverts the very mechanisms the OS uses to report system state.

A library rootkit targets user-space shared libraries such as DLLs or .so files to intercept API calls, operating above the kernel layer rather than modifying it.