← Back to Dashboard

Nidhogg

// Windows Kernel Rootkit Masterclass

8
Modules
C/C++
Language
Kernel
Privilege
3
Difficulty Tiers

An all-in-one Windows kernel rootkit for red teams: process hiding via DKOM, file and registry protection through IRP/callback hooking, ETW provider blinding, kernel callback manipulation, and memory scanner evasion. Communicates via IOCTL from a user-mode C++ client. By Idov31.

01 Beginner

Kernel vs User-Mode Evasion

Ring 0 vs ring 3 privilege, why kernel access is the ultimate evasion primitive, driver signing requirements, and Driver Signature Enforcement (DSE).

 02 Beginner

Windows Kernel Driver Basics

DriverEntry, IRP dispatch routines, IOCTL communication, device objects, symbolic links, and driver loading with sc.exe and kdmapper.

 03 Beginner

Process & Thread Manipulation

EPROCESS and ETHREAD structures, ActiveProcessLinks, Direct Kernel Object Manipulation (DKOM) for process hiding, and PID protection.

 04 Intermediate

File & Registry Protection

IRP_MJ_CREATE hooking for file protection, CmRegisterCallbackEx for registry callbacks, pre/post operation callbacks, and access denial.

 05 Intermediate

ETW Provider Disabling

ETW architecture internals, GuidEntry manipulation, disabling trace providers from kernel mode, and blinding EDR telemetry sources.

 06 Intermediate

Kernel Callbacks & Notification Routines

PsSetCreateProcessNotifyRoutine, ObRegisterCallbacks, image load notifications, removing EDR callback registrations from kernel arrays.

 07 Advanced

Memory Scanner Evasion

Defeating pe-sieve, hiding memory regions via VAD manipulation, PTE-level tricks, and preventing user-mode tools from inspecting protected processes.

 08 Advanced

Full Chain, IOCTL Interface & Detection

Complete Nidhogg architecture, the NidhoggClient user-mode tool, IOCTL command dispatch table, detection via driver verification, and PatchGuard/KPP.

References & Resources