shadow-rs is a Windows kernel rootkit written in Rust, demonstrating advanced techniques for kernel manipulation while leveraging Rust’s safety and performance features. This project is intended for educational and research purposes.

The project also provides useful crates for developing rootkits, such as shadowx, which consolidates core logic and essential techniques. It includes rootkit-specific tricks, with plans for additional features in future updates.

The documentation on how to execute CLI commands can be found on the Wiki

• Legal notice
• Features
• Installation
• Supported Platforms
• Build Instructions
  • Driver
  • Client
• Setup Instructions
  • Enable Test Mode
  • Debug via Windbg
  • Create/Start Service
• Contributing to shadow-rs
• References
• License

• ✅ Process (Hide / Unhide)
• ✅ Process Signature (PP / PPL)
• ✅ Process Protection (Anti-Kill / Dumping)
• ✅ Elevate Process to System
• ✅ Terminate Process
• ✅ Lists protected and hidden processes currently on the system

• ✅ Thread (Hide / Unhide)
• ✅ Thread Protection (Anti-Kill)
• ✅ Lists protected and hidden threads currently on the system

• ✅ Driver (Hide / Unhide)
• ✅ Enumerate Driver

• Driver Signature Enforcement (DSE)

  • ✅ DSE (Enable / Disable)

• Keylogger

  • ✅ Enable Keylogger

• ETWTI

  • ✅ ETWTI (Enable / Disable)

• ✅ List / Remove / Restore Callbacks
  • PsSetCreateProcessNotifyRoutine
  • PsSetCreateThreadNotifyRoutine
  • PsSetLoadImageNotifyRoutine
  • CmRegisterCallbackEx
  • ObRegisterCallbacks (PsProcessType / PsThreadType)
• ✅ Listing currently removed callbacks

• ✅ Ports (Hide / Unhide)

• ✅ Hide Module
• ✅ Enumerate Module

• ✅ Key and Values (Hide / Unhide)
• ✅ Registry Protection (Anti-Deletion e Overwriting)

• ✅ Process Injection - Shellcode (ZwCreateThreadEx)
• ✅ Process Injection - DLL (ZwCreateThreadEx)
• ✅ APC Injection - Shellcode

• Install Rust from here.
• Then follow the instructions provided by microsoft

• ✅ Windows 10 / 11 (x64)

To build the project, ensure you have the Rust toolchain installed.

To build the driver, first go to the driver folder and then run the following command (When you do the first build you have to be as administrator, but after that you won't need to):

cargo make default --release

This driver can be mapped using kdmapper among other exploit tools, for example, to put mapping support, use the command:

cargo make default --release --features mapper

To build the client, first go into the client folder, then run the following command:

cargo build --release

Since some features of the rootkit are not supported due to the controller mapping, use the following command to build the client with only the commands that can be executed with the mapping:

cargo build --release --features mapper

bcdedit /set testsigning on

bcdedit /debug on
bcdedit /dbgsettings net hostip:<IP> port:<PORT>

You can use Service Control Manager or OSR Driver Loader to load your driver.

To contribute to shadow-rs, follow these steps:

1. Fork this repository.
2. Create a branch: git checkout -b <branch_name>.
3. Make your changes and confirm them: git commit -m '<commit_message>'.
4. Send to the original branch: git push origin <project_name> / <local>.
5. Create the pull request.

Alternatively, consult the GitHub documentation on how to create a pull request.

• https://leanpub.com/windowskernelprogrammingsecondedition
• https://www.youtube.com/watch?v=t7Rx3crobZU&pp=ugMICgJwdBABGAHKBRBibGFja2hhdCByb290a2l0
• https://github.com/memN0ps/eagle-rs
• https://www.amazon.com/Rootkits-Bootkits-Reversing-Malware-Generation/dp/1593277164
• https://github.com/Idov31/Nidhogg
• https://www.unknowncheats.me/
• https://www.amazon.com.br/Rootkit-Arsenal-Escape-Evasion-Corners/dp/144962636X
• https://github.com/eversinc33/Banshee
• https://synzack.github.io/Blinding-EDR-On-Windows/
• https://github.com/JKornev/hidden
• https://www.amazon.com.br/Rootkits-Subverting-Windows-Greg-Hoglund/dp/0321294319
• https://github.com/mirror/reactos
• https://github.com/Kharos102/ReadWriteDriverSample
• https://imphash.medium.com/windows-process-internals-a-few-concepts-to-know-before-jumping-on-memory-forensics-part-4-16c47b89e826

This project is licensed under the MIT License