shadow-rs/docs

Windows Kernel Rootkit in Rust (shadow-rs) Documentation 🦀

This document presents an overview of the shadow-rs project, describing its features, instructions for use and details of the development process. shadow-rs is designed to provide an advanced set of tools for manipulating processes, threads, drivers and much more in the Windows kernel.

Table of contents

• Process

  • Process (Hide / Unhide)
  • Elevate Process to System
  • Process Signature (PP / PPL)
  • Process Protection (Anti-Kill / Dumping)
  • Terminate Process
  • Lists protected and hidden processes currently on the system

• Thread

  • Thread (Hide / Unhide)
  • Thread Protection (Anti-Kill)
  • Lists protected and hidden threads currently on the system

• Driver

  • Driver (Hide / Unhide)
  • Enumerate Driver

• Misc

  • Driver Signature Enforcement (DSE) (Enable / Disable)
  • Enable Keylogger
  • ETWTI (Enable / Disable)

• Port

  • Port (Hide / Unhide)

• Callbacks

  • List / Remove / Restore Callbacks
  • Listing currently removed callbacks

• Module

  • Hide Module
  • Enumerate Module

• Registry

  • Key and Values (Hide / Unhide)
  • Registry Protection (Anti-Deletion e Overwriting)

• Injection

  • Process Injection - Shellcode (ZwCreateThreadEx)
  • Process Injection - DLL (ZwCreateThreadEx)
  • APC Injection - Shellcode