{"id":13844520,"url":"https://github.com/ClownQq/YDArk","last_synced_at":"2025-07-11T23:33:46.497Z","repository":{"id":37487500,"uuid":"213541243","full_name":"ClownQq/YDArk","owner":"ClownQq","description":"X64内核小工具","archived":false,"fork":false,"pushed_at":"2024-01-18T05:31:40.000Z","size":468911,"stargazers_count":1192,"open_issues_count":25,"forks_count":211,"subscribers_count":28,"default_branch":"master","last_synced_at":"2024-11-21T17:41:31.597Z","etag":null,"topics":["pchunter","win64ast"],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ClownQq.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-10-08T03:30:28.000Z","updated_at":"2024-11-21T05:45:42.000Z","dependencies_parsed_at":"2024-11-21T17:42:31.104Z","dependency_job_id":null,"html_url":"https://github.com/ClownQq/YDArk","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/ClownQq/YDArk","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ClownQq%2FYDArk","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ClownQq%2FYDArk/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ClownQq%2FYDArk/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ClownQq%2FYDArk/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ClownQq","download_url":"https://codeload.github.com/ClownQq/YDArk/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ClownQq%2FYDArk/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":264914554,"owners_count":23682850,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["pchunter","win64ast"],"created_at":"2024-08-04T17:02:44.272Z","updated_at":"2025-07-11T23:33:45.491Z","avatar_url":"https://github.com/ClownQq.png","language":null,"funding_links":[],"categories":["Others"],"sub_categories":[],"readme":"# YDArk\r\n免责声明: 这只是一个免费的软件, 如果您使用本软件, 给您直接或者间接造成损失、损害, 本人概不负责. 从您使用本软件的一刻起, 将视为您已经接受了本免责声明.\r\n\r\n// 本软件加了VMProtect壳, 可能有些杀毒软件会报毒...请大家放心使用, 这属于杀毒软件误报.\r\n\r\n// 本软件免费, 但未获得作者书面授权, 禁止用于商业用途; 另外禁止本软件用于恶意用途(比如作为病毒木马的一部分、破解网吧收费系统等等).\r\n\r\n// 本软件仅限于学习交流，如侵权请在24小时进行删除.\r\n\r\n////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////\r\n\r\n// 本驱动加了VMProtect壳, 不支持启用内核隔离.\r\n\r\n// 驱动未进行驱动签名, 请自行对驱动文件签名或开启调试模式, (已签名但还加载驱动失败)请禁用Secure Boot或微软Ev签名或虚拟机使用.\r\n\r\n// 欢迎大家在使用中若是发现BUG, 请及时联系反馈, 将会尽快修复, 如果大家有好的建议或意见, 也可以联系以下QQ或QQ群.\r\n// QQ: 3269334485; QQ群: 399309204\r\n\r\n////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////\r\n\r\n\r\n// Tool screenshot\r\n![image](https://github.com/ClownQq/YDArk/blob/master/screenshots/Process.png)\r\n![image](https://github.com/ClownQq/YDArk/blob/master/screenshots/SystemNotify.png)\r\n\r\n// Process\r\nThreads                     View/Kill/Suspend/Resume\r\nModules                     View/Unload/Dump\r\nHandles                     View/Close/Modify Granted Access\r\nWindows                     View/Show/Hide/Maximized/Minimized/Enable/Disable/Close/Attack\r\nMemorys                     View/Dump/Modify Protection\r\nTimers                      View/Remove\r\nHotKeys                     View/Remove\r\n\r\n// Driver Module\r\nDriver                      View/Unload/Dump/View Hide Driver\r\n\r\n// Kernel\r\nSystem Notify               View/Remove/Disassembling\r\nFilter Driver               View/Remove/Disassembling\r\nDPC Timer                   View/Remove/Disassembling\r\nHal Call                    View/Restore/Disassembling\r\nWdf Call                    View/Restore/Disassembling\r\nFile System                 View/Remove/Disassembling\r\nObject Hijack               View/Restore (Disk)\r\nGlobal Descriptor Table     View\r\n\r\n// Kernel Hook\r\nSSDT                        View/Restore/Disassembling\r\nShadowSSDT                  View/Restore/Disassembling\r\nFSD                         View/Restore/Disassembling\r\nKeyboard                    View/Restore/Disassembling\r\nI8042prt                    View/Restore/Disassembling\r\nMouse                       View/Restore/Disassembling\r\nPartmgr                     View/Restore/Disassembling\r\nDisk                        View/Restore/Disassembling\r\nAtapi                       View/Restore/Disassembling\r\nAcpi                        View/Restore/Disassembling\r\nScsi                        View/Restore/Disassembling\r\nKernel Hook                 Scan/Restore/Disassembling\r\nObject Type                 View/Restore/Disassembling\r\nInterrupt Descriptor Table  View\r\n\r\n// User Hook\r\nMessage Hook                View/Remove\r\nUser Hook                   Scan/Restore\r\nKernel Hook Table           Scan/Restore\r\n\r\n// Net Work\r\nPort                        View/Remove\r\nTcpip                       View/Restore/Disassembling\r\nNsiproxy                    View/Restore/Disassembling\r\nTdx                         View/Restore/Disassembling\r\nWfp WfpFilter               View/Remove\r\nWfp Callout                 View\r\nNdis                        View\r\nIE Plugin                   View/Remove\r\nIE Shell                    View/Remove\r\nSPI                         View/Repair\r\nHosts                       View/Edit\r\n\r\n// Registry\r\nCreate/Enumerate/Delete/Rename/Export/View Watch\r\n\r\n// File\r\nCreate/Enumerate/Delete/Rename/View Lock/View File Pending/Delay Delete/Copy To/Copy In/Drag In\r\n\r\n// Startup Info\r\nStartup                     View/Remove\r\nServices                    View/Start/Stop/Pause/Resume/Restart/Delete\r\nSchedule Task               View/Disable/Enable/Delete\r\n\r\n// Monitor\r\nCreate Exit Process/Create Thread/Load Image/Load Driver/Remote Thread Injection\r\n\r\n// About\r\n\r\n\r\n////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////\r\n\r\n\r\n1.0.0.6:\r\n1.新增枚举/恢复Disk对象劫持\r\n\r\n1.0.0.7:\r\n1.优化枚举驱动模块\r\n2.修复17763-18362系统设置注册表值蓝屏\r\n3.修复界面最小化一段时间控件消失, 支持界面窗口最大化\r\n4.新增枚举/删除/修复启动项\r\n5.修复进程窗口功能\r\n\r\n1.0.0.8:\r\n1.修复恢复SSDT/SSSDT导致蓝屏\r\n2.新增恢复内核InlineHook\r\n\r\n1.0.0.9:\r\n1.新增检测更新\r\n2.新增对进程svchost.exe显示服务模块\r\n3.枚举枚举/启动/停止/暂停/恢复/重启服务\r\n4.新增枚举/禁用/启用/删除任务计划\r\n\r\n1.0.0.10:\r\n1.修复枚举线程模块BUG\r\n2.优化检测更新\r\n3.新增枚举/移除注册表监控修改回调(注册表窗口右键TREE控件)\r\n\r\n1.0.0.11:\r\n1.修复Win7-Win8系统回调中Thread类型显示为Process类型\r\n2.新增Ctrl+C复制一行\r\n3.新增监控进程/驱动加载/远线程注入(Stack加载符号比较慢, 取消加载符号将symsrv.dll重命名其他文件名即可)\r\n\r\n1.0.0.12:\r\n1.新增支持Windows10 18363\r\n2.新增监控创建退出线程/模块加载\r\n3.修复若干BUG\r\n\r\n1.0.0.13:\r\n1.新增支持繁体中文和英文\r\n\r\n1.0.0.14:\r\n1.新增进程创建Dump\r\n2.新增扫描Pte Hook\r\n\r\n1.0.0.15:\r\n1.修复导致文件路径异常BUG\r\n2.新增注册表导出.reg文件\r\n3.新增应用层扫描Inline钩子\r\n\r\n1.0.0.16:\r\n1.优化枚举驱动模块\r\n2.优化扫描内核钩子\r\n3.新增应用层扫描EAT钩子\r\n4.新增检测Infinity钩子(SSDT Tab弹框)\r\n\r\n1.0.0.17:\r\n1.新增支持7600\r\n2.新增网络 IE插件/右键菜单/SPI/Host\r\n\r\n1.0.0.18:\r\n1.新增系统杂项Tab\r\n2.修复扫描内核钩子不显示BUG\r\n\r\n1.0.1.1:\r\n1.更改工具图标\r\n2.新增应用层扫描IAT钩子(X64:Ntdll\\KernelBase\\Kernel32; X32:Ntdll)\r\n3.反汇编引擎更改为zydis(https://github.com/zyantific/zydis)\r\n4.加强扫描驱动模块\r\n5.优化内核钩子扫描(随机页表基址)\r\n\r\n1.0.1.2:\r\n1.修复进程保护个数有误BUG\r\n2.新增IRP分发例程显示(驱动模块Tab-右键菜单)\r\n3.新增文件目录拷贝\r\n4.新增枚举工作线程\r\n5.新增检测Sysenter钩子(SSDT Tab弹框)\r\n6.新增枚举ExCallBack(内核钩子Tab-Object钩子Tab)\r\n7.引用https://github.com/zodiacon/ProcMonX几个bmp图标\r\n\r\n1.0.1.3:\r\n1.修复FastFat、ExFat、MsFs个别原始函数获取失败BUG\r\n2.新增进程注入\r\n3.新增进程隐藏\r\n\r\n1.0.1.4:\r\n1.优化进程句柄信息\r\n2.新增文件保护\r\n\r\n1.0.1.5:\r\n1.新增支持Windows10 19041\r\n2.新增进程断链支持进程保护\r\n3.新增检测/移除ATs开机启动\r\n4.修复系统版本大于等于17134进程断链触发PG蓝屏; ps:vmware虚拟机使用请将vm3dmp.sys进程回调摘除, 否则进程退出蓝屏~\r\n5.加强获取驱动模块信息\r\n\r\n1.0.1.6:\r\n1.加强系统线程模块获取\r\n2.新增Windows10扫描驱动模块重命名\r\n3.新增系统变速(系统杂项Tab-杂项), 目前支持7600、7601、9200、9600、10240、10586、14393、15063\r\n\r\n1.0.1.7:\r\n1.更改工具图标(感谢群友提供)\r\n2.修复枚举驱动模块蓝屏\r\n3.修复监控功能蓝屏\r\n\r\n1.0.1.8:\r\n1.优化进程钩子扫描\r\n\r\n1.0.1.9:\r\n1.修复枚举服务失败BUG\r\n2.新增系统变速(系统杂项Tab-杂项), 16299-19041, 目前支持所有系统\r\n\r\n1.0.1.10:\r\n1.新增进程命令行\r\n2.新增修改进程路径\r\n3.新增修改进程父进程Id\r\n4.新增显示指定驱动线程(驱动模块Tab-右键-驱动线程)\r\n5.新增枚举/移除VEH VCH UEF(应用层钩子Tab-异常回调)\r\n\r\n1.0.1.11:\r\n1.新增支持Windows10 19042\r\n2.优化进程Inline钩子恢复\r\n3.优化进程内存属性修改\r\n4.修复应用层界面相关BUG\r\n5.新增标题广告(要恰饭的嘛)\r\n6.修复弹框1073错误\r\n\r\n1.0.2.1:\r\n1.修复19042 Dpc定时器枚举缺陷(感谢群友提醒)\r\n2.修复加载驱动缺陷\r\n\r\n1.0.2.2:\r\n1.新增支持Windows10 19043\r\n2.加强进程相关操作\r\n3.新增网络端口远程ip识别\r\n\r\n1.0.2.3:\r\n1.新增SSDT检测VtHook\r\n2.新增检测19041-19043 Infinity钩子(SSDT Tab弹框)\r\n3.移除检测软件更新\r\n\r\n1.0.2.4:\r\n1.新增支持Windows11 22000\r\n2.加强进程相关操作\r\n3.加强文件相关操作\r\n\r\n1.0.2.5:\r\n1.Added support for Windows10 19044\r\n2.Repair Windows Server 2016 loading bsod\r\n\r\n1.0.3.1:\r\n1.Added support for Windows10 19045\r\n2.Added support for Windows11 22621\r\n3.disable process hide\r\n4.Optimize file traversal\r\n\r\n1.0.3.2:\r\n1.Optimize process enumeration\r\n2.Optimize driver enumeration\r\n3.Optimize kernel hook scanning\r\n4.Fix Windows10 ssdt bug\r\n5.Fix process message bug\r\n6.Optimize Loading driver error code\r\n7.Added modification process timer time (milliseconds)\r\n\r\n1.0.3.3:\r\n1.Added support for Windows11 22631\r\n2.Repair driver module tab bsod\r\n3.Optimize hal information","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FClownQq%2FYDArk","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FClownQq%2FYDArk","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FClownQq%2FYDArk/lists"}