Kernel Rootkit

A WDM driver operating at Ring 0, built to understand exactly how DKOM-based detection evasion works by implementing it from the WDK documentation upward. Locates a target EPROCESS block by walking ActiveProcessLinks from PsInitialSystemProcess, then demonstrates how unlinking an entry from that list affects tools that enumerate processes via NtQuerySystemInformation, since most of them walk the same list internally.

User-mode communication goes through a device object and symbolic link via IoCreateDevice/IoCreateSymbolicLink, with IOCTL dispatch in the IRP_MJ_DEVICE_CONTROL handler, getting IRP completion right on every code path, including errors, was its own debugging exercise, since failing to complete an IRP hangs the calling thread indefinitely. Also explored SSDT hooking on an isolated test machine with PatchGuard disabled, specifically to understand the mechanism PatchGuard exists to prevent in production.