Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
VectorKernel — PoCs for Kernelmode rootkit techniques research. | Kitploit
Tools/GitHubGitHub/daem0nc0re/vectorkernel
Privilege EscalationPersistence MechanismsExploitationReverse EngineeringMalware AnalysisLearning & Education
GitHubdaem0nc0re/vectorkernel

VectorKernel

PoCs for Kernelmode rootkit techniques research.

View Repository
442654 months agoReviewed by Kitploit

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

VectorKernel

PoCs for Kernelmode rootkit techniques research or education. Currently focusing on Windows OS. All modules support x64 family 64bit OS only.

Environment

All modules are tested in Windows 11 x64. To test drivers, following options can be used for the testing machine:

  1. Enable Loading of Test Signed Drivers

  2. Setting Up Kernel-Mode Debugging

Each options require to disable secure boot.

Modules

Detailed information is given in README.md in each project's directories. All modules are tested in Windows 11.

Module NameDescription
BlockImageLoadPoCs to block driver loading with Load Image Notify Callback method.
BlockNewProcPoCs to block new process with Process Notify Callback method.
CreateTokenPoCs to get full privileged SYSTEM token with ZwCreateToken() API.
DropProcAccessPoCs to drop process handle access with Object Notify Callback.
ElevateHandlePoCs to elevate handle access with DKOM method.
FileDirHidePoCs to hide file/directory.
GetFullPrivsPoCs to get full privileges with DKOM method.
GetKeyStrokePoCs to log keyboard action with kernel driver.
GetProcHandlePoCs to get full access process handle from kernelmode.
InjectLibraryPoCs to perform DLL injection with Kernel APC Injection method.
MemReadPoCs to read arbitrary process memory.
ModHide

TODO

More PoCs especially about following things will be added later:

  • Notify callback
  • Filesystem mini-filter
  • Network mini-filter

Recommended References

  • Pavel Yosifovich, Windows Kernel Programming, 2nd Edition (Independently published, 2023)

  • Bruce Dang, Alexandre Gazet, Elias Bachaalany, and Sébastien Josse, Practical Reverse Engineering: x86, x64, ARM, Windows Kernel, Reversing Tools, and Obfuscation (Wiley Publishing, 2014)

  • Greg Hoglund, and Jamie Butler, Rootkits : Subverting the Windows Kernel (Addison-Wesley Professional, 2005)

  • Bill Blunden, The Rootkit Arsenal: Escape and Evasion in the Dark Corners of the System, 2nd Edition (Jones & Bartlett Learning, 2012)

  • Pavel Yosifovich, Mark E. Russinovich, Alex Ionescu, and David A. Solomon, Windows Internals, Part 1: System architecture, processes, threads, memory management, and more, 7th Edition (Microsoft Press, 2017)

  • Andrea Allievi, Mark E. Russinovich, Alex Ionescu, and David A. Solomon, Windows Internals, Part 2, 7th Edition (Microsoft Press, 2021)

  • Matt Hand, Evading EDR - The Definitive Guide to Defeating Endpoint Detection Systems (No Starch Press, 2023)

Download Tool
PoCs to hide loaded kernel drivers with DKOM method.
ProcHidePoCs to hide process with DKOM method.
ProcProtectPoCs to manipulate Protected Process.
QueryModulePoCs to perform retrieving kernel driver loaded address information.
StealTokenPoCs to perform token stealing from kernelmode.