ZeroMemoryEx/Chaos-Rootkit

Health v2 · maintenance only

Flags: no_license

Adoption not part of the score

1061 stars · 162 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Chaos-Rootkit is an x64 Ring 0 Windows kernel rootkit written in C++ as a research project to understand kernel internals and rootkit techniques. It demonstrates process hiding via DKOM, privilege elevation, driver swapping, file access restriction, and anti-malware bypass capabilities.

Use cases

• study Windows kernel rootkit techniques
• learn DKOM process hiding internals
• research driver signature and integrity bypass methods
• understand process protection levels in Windows
• malware analysis and defense training
• explore kernel driver swapping techniques

When to choose

• you are a security researcher studying rootkit internals
• you want to learn Windows kernel programming through real examples
• you are building defensive detections against rootkit techniques

When to avoid

• you need production software or a supported tool
• you cannot legally or ethically use offensive kernel code
• you need a signed, stable driver for deployment
• you are not familiar with Windows kernel internals

Facets

library · maturity active

security reverse-engineering security operating-systems developer-tools windows cpp rootkit kernel-driver windows-kernel dkom malware-research ring-0 privilege-escalation research

Member repositories

For agents

markdown · JSON · MCP: product_card(name="ZeroMemoryEx/Chaos-Rootkit")