{"id":14031616,"url":"https://github.com/joaoviictorti/shadow-rs","last_synced_at":"2025-04-08T16:01:30.581Z","repository":{"id":250337544,"uuid":"834176330","full_name":"joaoviictorti/shadow-rs","owner":"joaoviictorti","description":"Windows Kernel Rootkit in Rust","archived":false,"fork":false,"pushed_at":"2025-03-06T12:18:01.000Z","size":564,"stargazers_count":532,"open_issues_count":2,"forks_count":60,"subscribers_count":7,"default_branch":"main","last_synced_at":"2025-04-01T14:01:42.855Z","etag":null,"topics":["kernel","ring0","rootkit","rust","windows"],"latest_commit_sha":null,"homepage":"","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/joaoviictorti.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-07-26T15:27:57.000Z","updated_at":"2025-04-01T11:54:13.000Z","dependencies_parsed_at":"2024-08-29T04:51:18.795Z","dependency_job_id":"97a314ff-fcc2-469d-9309-76e8c38e4c91","html_url":"https://github.com/joaoviictorti/shadow-rs","commit_stats":null,"previous_names":["joaoviictorti/shadow-rs"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/joaoviictorti%2Fshadow-rs","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/joaoviictorti%2Fshadow-rs/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/joaoviictorti%2Fshadow-rs/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/joaoviictorti%2Fshadow-rs/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/joaoviictorti","download_url":"https://codeload.github.com/joaoviictorti/shadow-rs/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247878014,"owners_count":21011158,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["kernel","ring0","rootkit","rust","windows"],"created_at":"2024-08-11T23:01:09.357Z","updated_at":"2025-04-08T16:01:30.540Z","avatar_url":"https://github.com/joaoviictorti.png","language":"Rust","funding_links":[],"categories":["Rust","Projects"],"sub_categories":[],"readme":"# shadow-rs 🦀\r\n\r\n![Rust](https://img.shields.io/badge/made%20with-Rust-red)\r\n![Platform](https://img.shields.io/badge/platform-windows-blueviolet)\r\n![Forks](https://img.shields.io/github/forks/joaoviictorti/shadow-rs)\r\n![Stars](https://img.shields.io/github/stars/joaoviictorti/shadow-rs)\r\n![License](https://img.shields.io/github/license/joaoviictorti/shadow-rs)\r\n\r\n\u003cp align=\"center\"\u003e\r\n    \u003cimg height=\"450\" alt=\"shadow-rs\" src=\"shadow.png\"\u003e\r\n\u003c/p\u003e\r\n\r\n`shadow-rs` is a Windows kernel rootkit written in Rust, demonstrating advanced techniques for kernel manipulation while leveraging Rust’s safety and performance features. This project is intended for educational and research purposes.\r\n\r\nThe project also provides useful crates for developing rootkits, such as [**shadowx**](/shadowx/), which consolidates core logic and essential techniques. It includes rootkit-specific tricks, with plans for additional features in future updates.\r\n\r\nThe documentation on how to execute CLI commands can be found on the [**Wiki**](https://github.com/joaoviictorti/shadow-rs/wiki)\r\n\r\n## Table of Contents\r\n\r\n* [Notice](#legal-notice)\r\n* [Features](#features)\r\n* [Installation](#installation)\r\n* [Supported Platforms](#supported-Platforms)\r\n* [Build Instructions](#build-instructions)\r\n  * [Driver](#driver)\r\n  * [Client](#client)\r\n* [Setup Instructions](#setup-instructions)\r\n  * [Enable Test Mode](#enable-test-mode)\r\n  * [Debug via Windbg](#debug-via-windbg)\r\n  * [Create/Start Service](#createstart-service)\r\n* [Disclaimer](#disclaimer)\r\n* [Contributing to shadow-rs](#contributing-to-shadow-rs)\r\n* [References](#references)\r\n* [License](#license)\r\n\r\n## Notice\r\n\r\n\u003e [!IMPORTANT]  \r\n\u003e This project is under development.\r\n\r\n## Features\r\n \r\n### Process Features\r\n\r\n- ✅ Hide and unhide processes.\r\n- ✅ Modify process signature levels to handle `Protected Processes (PP)` and `Protected Process Light (PPL)`.\r\n- ✅ Protect processes against termination and memory dumping.\r\n- ✅ Elevate process privileges to SYSTEM, granting full administrative access.\r\n- ✅ Terminate target processes.\r\n- ✅ List all protected and hidden processes.\r\n\r\n### Thread Features\r\n\r\n- ✅ Hide and unhide threads.\r\n- ✅ Protect threads from termination or suspension.\r\n- ✅ List all protected and hidden threads\r\n\r\n### Driver Features\r\n\r\n- ✅ Hide and unhide kernel-mode drivers.\r\n- ✅ Enumerate all loaded drivers.\r\n- ✅ Enable or disable Driver Signature Enforcement (`DSE`) to allow loading of unsigned drivers.\r\n- ✅ Blocking Driver Loading.\r\n\r\n### Callback Features\r\n\r\n- ✅ List registered callbacks for process creation, thread creation, image loading, and registry operations.\r\n- ✅ Remove or restore specific callbacks.\r\n- ✅ List all removed callbacks.\r\n\r\n### Misc Features\r\n\r\n- ✅ Capture keystrokes from user input in real-time with kernel-level interception.\r\n- ✅ Disable Microsoft-Windows-Threat-Intelligence (`EtwTi`).\r\n- ✅ Cleaning Driver Artifacts from Memory Dumps in Case of BSOD.\r\n- ✅ Compile Encryption String.\r\n- ✅ Support for Reflective Driver Loading.\r\n\r\n### User Mode Code Execution\r\n\r\n- ✅ Inject shellcode or DLLs into processes using `ZwCreateThreadEx`.\r\n- ✅ Asynchronous Procedure Call (`APC`) injection to execute shellcode or DLLs in alertable threads.\r\n- ✅ Execute shellcode in processes using `Thread Hijacking`.\r\n\r\n### Module Features\r\n\r\n- ✅ Hide modules from process memory listings.\r\n- ✅ Enumerate all loaded modules.\r\n\r\n### Registry Features\r\n\r\n- ✅ Hide and unhide registry keys and values to prevent detection and manipulation.\r\n- ✅ Apply registry protection to prevent key or value deletion or overwriting.\r\n\r\n### Network Features\r\n\r\n- ✅ Hide and unhide network ports from netstat and similar monitoring tools.\r\n\r\n## Installation\r\n\r\n* Install Rust from [**here**](https://www.rust-lang.org/learn/get-started).\r\n* Follow [Microsoft's guide](https://github.com/microsoft/windows-drivers-rs?tab=readme-ov-file#getting-started) to set up Rust for kernel development. \r\n\r\n## Supported Platforms\r\n\r\n- ✅ Windows 10 / 11 (x64 only)\r\n\r\n## Build Instructions\r\n\r\n#### Driver\r\n\r\nNavigate to the [driver](/driver) directory and build the kernel driver:\r\n\r\n```cmd\r\ncargo make default --release\r\n```\r\n\r\n\u003e [!IMPORTANT]  \r\n\u003e Note: The first build must be executed as Administrator. Subsequent builds do not require elevated privileges.\r\n\r\nTo enable mapping support for tools like kdmapper, compile with:\r\n```cmd\r\ncargo make default --release --features mapper\r\n```\r\n\r\n#### Client\r\n\r\nNavigate to the [client](/client) directory and build the user-mode client:\r\n```cmd\r\ncargo build --release\r\n```\r\n\r\nFor compatibility with mapped drivers:\r\n```cmd\r\ncargo build --release --features mapper\r\n```\r\n\r\n## Setup Instructions\r\n\r\n#### Enable Test Mode or Test Signing Mode \r\n\r\n```\r\nbcdedit /set testsigning on\r\n```\r\n\r\n#### Create / Start Service\r\n\r\nYou can use [Service Control Manager](https://docs.microsoft.com/en-us/windows/win32/services/service-control-manager) or [OSR Driver Loader](https://www.osronline.com/article.cfm%5Earticle=157.htm) to load your driver.\r\n\r\n## Debugging \r\n\r\nUse Windbg to attach to the kernel and monitor driver activity.\r\n\r\n```\r\nbcdedit /debug on\r\nbcdedit /dbgsettings net hostip:\u003cIP\u003e port:\u003cPORT\u003e\r\n```\r\n\r\n## Contributing to shadow-rs\r\nTo contribute to `shadow-rs`, follow these steps:\r\n\r\n1. Fork this repository.\r\n2. Create a branch: ```git checkout -b \u003cbranch_name\u003e```.\r\n3. Make your changes and confirm them: ```git commit -m '\u003ccommit_message\u003e'```.\r\n4. Send to the original branch: ```git push origin \u003cproject_name\u003e / \u003clocal\u003e```.\r\n5. Create the pull request.\r\n\r\nAlternatively, consult the [**GitHub documentation**](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests) on how to create a pull request.\r\n\r\n## Disclaimer\r\n\r\nThis project is for educational and research purposes. Malicious use of the software is strictly prohibited and discouraged. I am not responsible for any damage caused by improper use of the software.\r\n\r\n## References\r\n\r\nI want to express my gratitude to these projects that inspired me to create `shadow-rs` and contribute with some features:\r\n\r\n* [Hidden](https://github.com/JKornev/hidden)\r\n* [Nidhogg](https://github.com/Idov31/Nidhogg)\r\n* [eagle-rs](https://github.com/memN0ps/eagle-rs)\r\n* [Banshee](https://github.com/eversinc33/Banshee)\r\n* [ReadWriteDriverSample](https://github.com/Kharos102/ReadWriteDriverSample)\r\n\r\n### Other Essential Resources:\r\n\r\nThese materials and research have been invaluable in deepening my understanding of Windows kernel development:\r\n\r\n* [UnKnoWnCheaTs](https://www.unknowncheats.me)\r\n* [Reactos](https://github.com/mirror/reactos)\r\n* [Blinding EDR On Windows](https://synzack.github.io/Blinding-EDR-On-Windows)\r\n* [Windows Kernel Programming - Pavel](https://leanpub.com/windowskernelprogrammingsecondedition)\r\n* [Rootkit Arsenal Escape Evasion Corners](https://www.amazon.com.br/Rootkit-Arsenal-Escape-Evasion-Corners/dp/144962636X) \r\n* [Rootkits Subverting Windows Greg Hoglund](https://www.amazon.com.br/Rootkits-Subverting-Windows-Greg-Hoglund/dp/032129431)\r\n* [Rootkits Bootkits Reversing Malware Generation](https://www.amazon.com/Rootkits-Bootkits-Reversing-Malware-Generation/dp/1593277164)\r\n* [Memory Forensics](https://imphash.medium.com/windows-process-internals-a-few-concepts-to-know-before-jumping-on-memory-forensics-part-4-16c47b89e826)\r\n* [Leveraging Rootkits for Post-Exploitation - Black Hat](https://www.youtube.com/watch?v=t7Rx3crobZU\u0026pp=ugMICgJwdBABGAHKBRBibGFja2hhdCByb290a2l0)\r\n\r\n## License\r\n\r\nThis project is licensed under the [**MIT License**](/LICENSE). See the LICENSE file for details.","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjoaoviictorti%2Fshadow-rs","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjoaoviictorti%2Fshadow-rs","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjoaoviictorti%2Fshadow-rs/lists"}