shadow-rs/docs

Windows Kernel Rootkit in Rust (shadow-rs) Documentation 🦀

This document presents an overview of the shadow-rs project, describing its features, instructions for use and details of the development process. shadow-rs is designed to provide an advanced set of tools for manipulating processes, threads, drivers and much more in the Windows kernel.

Table of contents

• Process

  • Hide / Unhide Process
  • Elevate Process to System
  • Process Signature (PP / PPL)
  • Terminate Process
  • Lists protected and hidden processes currently on the system

• Thread

  • Hide / Unhide Thread
  • Thread Protection (Anti-Kill)
  • Lists protected and hidden threads currently on the system

• Driver

  • Driver (Hide / Unhide)
  • Enumerate Driver

• Misc

  • Driver Signature Enforcement (DSE) Enable / Disable
  • Keylogger Start / Stop
  • ETWTI Enable / Disable

• Callbacks

  • List / Remove / Restore Callbacks
  • Listing currently removed callbacks

• Module

  • Hide Module
  • Enumerate Module

• Registry

  • Hide Key and Values
  • Registry Protection

• Injection

  • Process Injection - Shellcode / DLL (ZwCreateThreadEx)
  • APC Injection - Shellcode