{"id":21230387,"url":"https://github.com/idov31/jormungandr","last_synced_at":"2025-04-13T06:41:46.676Z","repository":{"id":178152069,"uuid":"658222855","full_name":"Idov31/Jormungandr","owner":"Idov31","description":"Jormungandr is a kernel implementation of a COFF loader, allowing kernel developers to load and execute their COFFs in the kernel. ","archived":false,"fork":false,"pushed_at":"2023-09-26T18:06:53.000Z","size":50,"stargazers_count":229,"open_issues_count":0,"forks_count":27,"subscribers_count":8,"default_branch":"master","last_synced_at":"2025-03-26T23:08:40.486Z","etag":null,"topics":["cpp","cyber-security","cybersecurity","driver","infosec","kernel","red-team","redteam","rootkit","windows","windows-rootkits"],"latest_commit_sha":null,"homepage":"","language":"C++","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Idov31.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-06-25T06:24:16.000Z","updated_at":"2025-02-02T17:12:43.000Z","dependencies_parsed_at":"2023-09-26T22:24:42.590Z","dependency_job_id":null,"html_url":"https://github.com/Idov31/Jormungandr","commit_stats":null,"previous_names":["idov31/jormungandr"],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Idov31%2FJormungandr","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Idov31%2FJormungandr/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Idov31%2FJormungandr/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Idov31%2FJormungandr/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Idov31","download_url":"https://codeload.github.com/Idov31/Jormungandr/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248675434,"owners_count":21143763,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cpp","cyber-security","cybersecurity","driver","infosec","kernel","red-team","redteam","rootkit","windows","windows-rootkits"],"created_at":"2024-11-20T23:37:49.313Z","updated_at":"2025-04-13T06:41:46.653Z","avatar_url":"https://github.com/Idov31.png","language":"C++","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Jormungandr\n\n![image](https://img.shields.io/badge/C%2B%2B-00599C?style=for-the-badge\u0026logo=c%2B%2B\u0026logoColor=white) ![image](https://img.shields.io/badge/Windows-0078D6?style=for-the-badge\u0026logo=windows\u0026logoColor=white)\n\nJormungandr is a kernel implementation of a [COFF](https://en.wikipedia.org/wiki/COFF) loader, allowing kernel developers to load and execute their COFFs in the kernel.\nThe **only** supported type of COFF is an x64 kernel COFF (meaning, a COFF that uses functions from either NTOSKRNL or SSDT). This project is not supported to run with [VBS](https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-hvci-enablement) enabled because it is using pools with execute permissions but this project should work for any version of Windows starting from Windows 7.\n\nIf you are unfamiliar with COFF and COFF loading, please refer to [TrustedSec's blog post about COFF loaders](https://www.trustedsec.com/blog/coffloader-building-your-own-in-memory-loader-or-how-to-run-bofs/).\n\n## Basic Usage\n\nTo communicate with the driver, you can use and compile the [example](./Example/JormungandrExample.cpp) file with [CMake](#building-the-client).\nThis is an example of the most basic usage:\n\n```cpp\nint main() {\n    HANDLE hDrv = CreateFile(DRIVER_NAME, GENERIC_WRITE | GENERIC_READ, 0, nullptr, OPEN_EXISTING, 0, nullptr);\n\n    // ...\n\n    BOOL result = WriteFile(hDrv, \u0026data, sizeof(data), \u0026bytesWritten, NULL);\n\n    // ...\n}\n```\n\nTo run and execute the existing example, all you have to do is [create your own COFF](#writing-kernel-coffs) or use the [example](./ExampleKernelCoff/example.c):\n\n```sh\nJormungandrExample.exe example.out\n```\n\n![example](./images/coff_loaded.png)\n\n## Writing kernel COFFs\n\nTo write a kernel COFF, create a new C file and import the functions you want as follows:\n\n```c\nDECLSPEC_IMPORT \u003cFUNCTION_RETURN_TYPE\u003e __cdecl \u003cLIBRARY\u003e$\u003cFUNCTION_NAME\u003e(\u003cPARAMETERS\u003e);\n```\n\nReplace the `\u003cFUNCTION_RETURN_TYPE\u003e` with the return type of the function you want, the `\u003cLIBRARY\u003e` can be either `ntoskrnl` or `ntdll` the rest is the signature of the function. After the function is imported, you can use it the way you are used to writing code.\n\nTo build the COFF, use `mingw` with the following command:\n\n```sh\nx86_64-w64-mingw32-gcc -c example.c -o example.out\n```\n\n## Setup\n\n### Building the client\n\nTo compile the client, you will need to install [CMake](https://community.chocolatey.org/packages/cmake.install/3.13.1) and [Visual Studio 2022](https://visualstudio.microsoft.com/thank-you-downloading-visual-studio/?sku=Community\u0026rel=16) installed and then just run:\n\n```sh\ncd \u003cJORMUNGANDR PROJECT DIRECTORY\u003e/Example\nmkdir build\ncd build\ncmake ..\ncmake --build .\n```\n\n### Building the driver\n\nTo compile the project, you will need the following tools:\n\n- [Visual Studio 2022](https://visualstudio.microsoft.com/thank-you-downloading-visual-studio/?sku=Community\u0026rel=16)\n- [Windows Driver Kit](https://docs.microsoft.com/en-us/windows-hardware/drivers/download-the-wdk)\n\nClone the repository and build the driver.\n\n## Testing\n\nTo test it in your testing environment run those commands with elevated cmd:\n\n```cmd\nbcdedit /set testsigning on\n```\n\nAfter rebooting, create a service and run the driver:\n\n```cmd\nsc create nidhogg type= kernel binPath= C:\\Path\\To\\Driver\\Nidhogg.sys\nsc start nidhogg\n```\n\n## Debugging\n\nTo debug the driver in your testing environment run this command with elevated cmd and reboot your computer:\n\n```cmd\nbcdedit /debug on\n```\n\nAfter the reboot, you can see the debugging messages in tools such as [DebugView](https://learn.microsoft.com/en-us/sysinternals/downloads/debugview).\n\n## Resources\n\n- [TrustedSec's COFFLoader](https://github.com/trustedsec/COFFLoader)\n\n## Contributions\n\nThanks a lot to those people that contributed to this project:\n\n- [BlackOfWorld](https://github.com/BlackOfWorld)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fidov31%2Fjormungandr","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fidov31%2Fjormungandr","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fidov31%2Fjormungandr/lists"}