Nidhogg - Windows rootkit for Intel x64 with 25+ features, d

项目说明

Nidhogg

<p align="center">
<img alt="Logo" src="./images/logo.png">
</p>

!image !image

Nidhogg is a multi-functional rootkit to showcase the of operations that can be done from kernel space. The goal of Nidhogg is to provide an all-in-one and easy-to-use rootkit with multiple helpful functionalities for operations. Besides that, it can also easily be integrated with your C2 framework.

Nidhogg can work on any of x64 Windows 10 and Windows 11.

This repository contains a kernel driver with a C++ program to communicate with it.

If you want to know more, check out the wiki for a detailed explanation.

Current Features

> [!IMPORTANT]
> All the features have been fully tested up to Windows 11 25H2.
> If you encounter a problem, please open an issue after checking there isn't already an open issue.

Reflecti

> [!WARNING]
> When doing reflecti, there are features that will be disabled by default and the automatic graceful unload of hidden modules and unhooking callbacks will not work as well.
> It is the user's responsibility to ensure to manually unload any hidden modules upon process termination and unhook any callbacks if the target driver is unloading. Failing to do so may lead to system instability or crashes.

Since v0.3, Nidhogg can be reflectively loaded with kdmapper but because PatchGuard will be automatically triggered if the dri callbacks, Nidhogg will not register any callback. Meaning, that if you are loading the dri these features will be disabled by default:

Nidhogg Object File (NOF)

Since v2.0, Nidhogg has a new capability named "Nidhogg Object File" (NOF) for kernel-mode COFF execution. This means, you can write your own kernel-mode code and compile it to a COFF file which has access to:

This feature is not compatible with Based Security (VBS) as it both HVCI and kCFG.

Script Execution (DEPRECATED IN V2.0)

Since v1.0, Nidhogg can execute NidhoggScripts - a tool that allows one to execute a couple of commands one after another, thus, creating playbooks for Nidhogg. To see how to write one check out the wiki.

Due to hard maintainability and the fact that it isn't a popular feature, it has been deprecated in v2.0 and will be removed in the next major release. It will be replaced with another capability named "Nidhogg Object File" (NOF) for kernel-mode COFF execution, which will ha to Nidhogg's API.

Initial Operations (DEPRECATED IN V2.0)

Since v1.0, Nidhogg can execute NidhoggScripts as initial operations as well. Meaning, that if it spots the file out.ndhg in the root of the project directory (the same directory as the Python file) it will execute the file each time the driver is running.

Due to hard maintainability and the fact that it isn't a popular feature, it has been deprecated in v2.0 and will be removed in the next major release. It will be replaced with another capability named "Nidhogg Object File" (NOF) for kernel-mode COFF execution, which will ha to Nidhogg's API.

PatchGuard triggering features

> [!CAUTION]
> The following features are known to trigger PatchGuard, you can still use them at your own risk.

Basic Usage

To see the a commands you can run NidhoggClient.exe or look at the wiki for detailed information regarding how to use each command, the parameters it takes and how it works.

Setup

Building the client

To compile the client, you will need to have Studio 2022 installed and then just build the project like any other Studio project.

Building the driver

To compile the project, you will need the following tools:

Clone the repository and build the project:

Dri

To test it in your testing en run those commands with elevated cmd:

After rebooting, create a service and run the driver:

Debugging

To debug the driver in your testing en run this command with elevated cmd and reboot your computer:

After the reboot, you can see the debugging messages in tools such as DebugView.

Resources

Contributions

Thanks a lot to those people who contributed to this project:

![BlackOfWorld]()&nbsp;&nbsp;&nbsp;&nbsp;<img src=" width="60" height="60" alt="0nlyDev">&nbsp;&nbsp;&nbsp;&nbsp;<img src=" width="60" height="60" alt="SLiNv">&nbsp;&nbsp;&nbsp;&nbsp;<img src=" width="60" height="60" alt="Grovvik">

项目信息

开发语言：C++

Star 数：2495

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Windows rootkit for Intel x64 with 25+ features, demonstrating rootkit techniques compatible with all Windows 10 and Windows 11 versions.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。