Tools
TitanHide
mrexodia/TitanHide
A Windows kernel driver that hooks Nt* routines to hide debuggers from selected processes, built for reverse engineering and security research inside virtual machines.
Topics
Related projects
Chaos-Rootkit1.1kA Windows Ring 0 rootkit research project with a GUI, demonstrating kernel techniques such as process hiding, privilege elevation, driver swapping and file protection for security study.
PowerShell56.1kA cross-platform command-line shell and scripting language for automation, structured data processing, REST APIs, and system configuration tasks.
sogen3.9kSogen is a userspace Windows and Linux emulator that runs real system DLLs at CPU and syscall level, with deterministic execution, debugging, hooking and snapshots.
Windows-Kernel-Explorer2.7kA Windows kernel research tool offering process, file, registry, driver and hook inspection plus low-level system management from Windows XP to 11.
EfiGuard2.6kEfiGuard is a portable UEFI bootkit for x64 Windows that disables PatchGuard and Driver Signature Enforcement at boot. It is a low-level security research tool for kernel debugging and driver testing.
Nidhogg2.6kNidhogg is a Windows kernel rootkit for security research and red-team operations. It demonstrates process, file and registry hiding, privilege elevation, injection, credential dumping and kernel callback manipulation.