Kdmapper

kdmapper is a kernel driver mapper and loader designed to deploy unsigned binaries into privileged kernel memory. It functions as a manual mapper that resolves imports and relocations to execute unsigned code in a privileged environment.

The tool bypasses driver signature enforcement by leveraging vulnerable signed drivers to gain write access to protected kernel memory regions. It includes a kernel offset resolver that parses debug symbol files to identify correct memory addresses across different operating system builds.

To maintain stealth, the project implements driver trace obfuscation by scrubbing kernel memory tables and removing entries from system driver lists. It manages the allocation of non-paged kernel memory and parses portable executable structures to determine memory requirements and entry point locations.

Features

Manual Memory Mapping - Provides manual mapping of driver binaries into kernel memory including import and relocation resolution.
Kernel Driver Mappers - Maps unsigned binaries into kernel memory by leveraging vulnerable signed drivers to bypass signature enforcement.
BYOVD Exploitation - Leverages vulnerable signed drivers to gain write access to protected kernel memory regions.
Driver Trace Obfuscation - Implements memory table scrubbing and driver list removal to hide the presence of manually loaded binaries.
Kernel Offset Resolvers - Identifies correct memory addresses across different operating system builds by parsing debug symbol files.
Kernel Symbol Resolution - Parses debug symbol files to identify the exact memory addresses of internal kernel functions.
Unsigned Driver Mapping - Loads unsigned binaries into kernel memory by leveraging a vulnerable signed driver to bypass signature enforcement.
Unsigned Driver Loading - Loads unsigned drivers into the Windows kernel by bypassing driver signature enforcement via vulnerable signed binaries.
Stealthy Driver Loaders - Provides a low-level utility for deploying unsigned kernel-mode code while obfuscating the mapping process.
Non-Paged Memory Orchestration - Manages the allocation and mapping of non-paged kernel memory required to execute unsigned binaries.
PE Header Parsing - Analyzes Portable Executable structures to determine necessary memory size and entry point locations.

Istoric stele

TheCruZkdmapper

Name: thecruz/kdmapper
Author: TheCruZ

View on GitHub

2,754 stele613 fork-uriC++mit3 vizualizări

Kdmapper

Features

Manual Memory Mapping - Provides manual mapping of driver binaries into kernel memory including import and relocation resolution.
Kernel Driver Mappers - Maps unsigned binaries into kernel memory by leveraging vulnerable signed drivers to bypass signature enforcement.
BYOVD Exploitation - Leverages vulnerable signed drivers to gain write access to protected kernel memory regions.
Driver Trace Obfuscation - Implements memory table scrubbing and driver list removal to hide the presence of manually loaded binaries.
Kernel Offset Resolvers - Identifies correct memory addresses across different operating system builds by parsing debug symbol files.
Kernel Symbol Resolution - Parses debug symbol files to identify the exact memory addresses of internal kernel functions.
Unsigned Driver Mapping - Loads unsigned binaries into kernel memory by leveraging a vulnerable signed driver to bypass signature enforcement.
Unsigned Driver Loading - Loads unsigned drivers into the Windows kernel by bypassing driver signature enforcement via vulnerable signed binaries.
Stealthy Driver Loaders - Provides a low-level utility for deploying unsigned kernel-mode code while obfuscating the mapping process.
Non-Paged Memory Orchestration - Manages the allocation and mapping of non-paged kernel memory required to execute unsigned binaries.
PE Header Parsing - Analyzes Portable Executable structures to determine necessary memory size and entry point locations.

Alternative open-source pentru Kdmapper

Proiecte open-source similare, clasificate după numărul de funcționalități comune cu Kdmapper.

trickster0/offensiverust
trickster0/OffensiveRust
2,984Vezi pe GitHub
OffensiveRust is a red team toolkit and malware development kit written in Rust. It serves as an evasion framework and post-exploitation library, providing a collection of offensive security primitives and a Windows API wrapper for interacting with low-level system functions and undocumented APIs. The project focuses on bypassing security software through direct system calls, memory obfuscation, and stealthy payload execution. It implements techniques to defeat static binary analysis via compile-time string encryption and payload obfuscation, while avoiding detection using parent process ID s
Rust
Vezi pe GitHub2,984
volatilityfoundation/volatility3
volatilityfoundation/volatility3
4,192Vezi pe GitHub
Volatility3 is a memory forensics framework and analysis tool used to parse volatile memory dumps. It extracts digital artifacts and reconstructs the runtime state of a system to recover process information, network artifacts, and other forensic evidence. The system functions as a plugin-based forensic engine and an operating system symbol resolver. It maps raw memory addresses to known system structures using symbol tables and translation layers, and provides an extensible architecture for creating custom scanners and renderers. The framework includes a command-line memory explorer for real
Python
Vezi pe GitHub4,192
iovisor/bcc
iovisor/bcc
22,459Vezi pe GitHub
BCC is an eBPF development toolkit and tracing framework used for monitoring and analyzing the Linux kernel. It functions as a performance analysis tool and debugging utility to capture system events, measure kernel latency, and provide network observability. The project distinguishes itself by providing a build system that integrates with LLVM to compile C-like code into BPF bytecode at runtime. It utilizes BPF Type Format data for relocations to maintain cross-kernel compatibility and extracts kernel headers to ensure the generated programs match the specific kernel version. The toolkit co
C
Vezi pe GitHub22,459

Întrebări frecvente

Ce face thecruz/kdmapper?

Care sunt principalele funcționalități ale thecruz/kdmapper?

Principalele funcționalități ale thecruz/kdmapper sunt: Manual Memory Mapping, Kernel Driver Mappers, BYOVD Exploitation, Driver Trace Obfuscation, Kernel Offset Resolvers, Kernel Symbol Resolution, Unsigned Driver Mapping, Unsigned Driver Loading.

Care sunt câteva alternative open-source pentru thecruz/kdmapper?

Alternativele open-source pentru thecruz/kdmapper includ: trickster0/offensiverust — OffensiveRust is a red team toolkit and malware development kit written in Rust. It serves as an evasion framework and… volatilityfoundation/volatility3 — Volatility3 is a memory forensics framework and analysis tool used to parse volatile memory dumps. It extracts digital… iovisor/bcc — BCC is an eBPF development toolkit and tracing framework used for monitoring and analyzing the Linux kernel. It… pwndbg/pwndbg — pwndbg is a GDB plugin and binary analysis framework designed for reverse engineering, exploit development, and… s-matyukevich/raspberry-pi-os — This project is a bare-metal operating system developed for ARM64 architecture. It serves as a low-level… mantvydasb/redteaming-tactics-and-techniques — This project is a red teaming knowledge base and offensive security playbook designed to simulate adversary behavior.…

Kdmapper

Features

Istoric stele

Kdmapper

Features

Alternative open-source pentru Kdmapper

trickster0/OffensiveRust

volatilityfoundation/volatility3

iovisor/bcc

Întrebări frecvente

Istoric stele

Întrebări frecvente

Alternative open-source pentru Kdmapper

trickster0/OffensiveRust

volatilityfoundation/volatility3

iovisor/bcc

pwndbg/pwndbg