1 repositorio
Techniques for scrubbing kernel memory tables and system driver lists to hide the presence of unauthorized code.
Distinct from Offensive Kernel Drivers: Distinct from Offensive Kernel Drivers: focuses specifically on the stealth and cleanup phase of driver deployment rather than the exploitation primitive.
Explore 1 awesome GitHub repository matching operating systems & systems programming · Driver Trace Obfuscation. Refine with filters or upvote what's useful.
kdmapper is a kernel driver mapper and loader designed to deploy unsigned binaries into privileged kernel memory. It functions as a manual mapper that resolves imports and relocations to execute unsigned code in a privileged environment. The tool bypasses driver signature enforcement by leveraging vulnerable signed drivers to gain write access to protected kernel memory regions. It includes a kernel offset resolver that parses debug symbol files to identify correct memory addresses across different operating system builds. To maintain stealth, the project implements driver trace obfuscation
Implements memory table scrubbing and driver list removal to hide the presence of manually loaded binaries.