Windows Rootkit Driver (WDM)
$499.99
Windows Kernel Rootkit — WDM Driver (x64)
Plain WDM (not KMDF) kernel driver for Windows 10/11 x64 with four real ring-0 protection modules plus a user-mode controller. v2.0 fixed the honesty gaps of v1.0: every listed technique is actually implemented and every limitation is documented.
- Process hiding: DKOM unlink of ActiveProcessLinks with safe re-link at the original list position (per-build offsets).
- File hiding: IRP_MJ_DIRECTORY_CONTROL hook on the NTFS driver filtering FileBothDirectoryInformation entries.
- Network hiding: IRP_MJ_DEVICE_CONTROL hook on \Driver\nsiproxy with a MIB table filter in caller context (KeStackAttachProcess) — hides connections from netstat/TCPView.
- Registry protection: CmRegisterCallbackEx blocking delete/rename/modify on protected keys.
- Controller: user-mode loader (SCM service + DeviceIoControl).
- Build: ZionRootkit.vcxproj (WDK 10.0.22621+, VS2022), ZionRootkit.inf, Makefile reference. Requires test signing mode.
Honest limits: no PatchGuard bypass is claimed; network hiding targets nsiproxy MIB queries, not the TCPIP driver itself.
Key Features
- Plain WDM kernel driver (honest about it: v1.0 claimed KMDF but was WDM)
- Process hiding: DKOM unlink of ActiveProcessLinks with SAVED neighbors and safe re-link on unhide/unload
- File hiding: IRP_MJ_DIRECTORY_CONTROL hook on NTFS filtering FileBothDirectoryInformation
- Network hiding: REAL nsiproxy IRP_MJ_DEVICE_CONTROL hook filtering MIB TCP/UDP tables (v1.0 only documented it)
- Registry protection: CmRegisterCallbackEx blocking delete/rename/modify on protected keys
- Usermode loader with SCM load/unload and DeviceIoControl for every command
- WDK build project (ZionRootkit.vcxproj) and installation INF included
Requirements
- Windows Driver Kit 10.0.22621+ and Visual Studio 2022 to build
- Windows 10/11 x64 in Test Signing Mode
- Administrator privileges
- EPROCESS offsets per build (verified via WinDbg; 22H2 offsets included)
Changelog
- 2.0 (2026-10-19): honest WDM rewrite — real nsiproxy hook, safe process re-link, fixed IOCTL buffer checks, .vcxproj+.inf, honest limitations (PatchGuard, DSE) documented
- 1.0 (2025-01-25): initial release (mislabeled KMDF; NSI hook not implemented)
Package Contents
Exact contents of the download archive (11 files):
| rootkit.c | 10,151 B |
| Makefile | 1,049 B |
| file_hiding.c | 7,763 B |
| process_hiding.c | 8,192 B |
| README.md | 3,926 B |
| rootkit.h | 6,525 B |
| loader.c | 7,712 B |
| ZionRootkit.inf | 1,330 B |
| network_hiding.c | 9,131 B |
| registry_protection.c | 7,352 B |
| ZionRootkit.vcxproj | 3,075 B |
Related Tools
Malware Development
Process Hollowing Injector (C)
Malware Development
Reflective DLL Injection Template
Malware Development
Python RAT Core Module
Malware Development