Tools
Chaos-Rootkit
ZeroMemoryEx/Chaos-Rootkit
A Windows Ring 0 rootkit research project with a GUI, demonstrating kernel techniques such as process hiding, privilege elevation, driver swapping and file protection for security study.
Topics
Related projects
TitanHide3kA Windows kernel driver that hooks Nt* routines to hide debuggers from selected processes, built for reverse engineering and security research inside virtual machines.
Windows-Kernel-Explorer2.7kA Windows kernel research tool offering process, file, registry, driver and hook inspection plus low-level system management from Windows XP to 11.
EfiGuard2.6kEfiGuard is a portable UEFI bootkit for x64 Windows that disables PatchGuard and Driver Signature Enforcement at boot. It is a low-level security research tool for kernel debugging and driver testing.
Nidhogg2.6kNidhogg is a Windows kernel rootkit for security research and red-team operations. It demonstrates process, file and registry hiding, privilege elevation, injection, credential dumping and kernel callback manipulation.
winfsp9kA Windows file-system development framework that provides a kernel driver and user-mode APIs, enabling developers to build custom file systems similar to FUSE.
reactos18.5kA free open-source operating system compatible with Windows apps and drivers.