# ZeroMemoryEx/Chaos-Rootkit

Now You See Me, Now You Don't

Repository: https://github.com/ZeroMemoryEx/Chaos-Rootkit
Canonical: https://ross.abutalabs.com/products/chaos-rootkit
Homepage: https://www.hackandhide.com/chaos-rootkit-internals-explained/
Language: C++
License Family: other
Topics: driver, kernel, malware-development, rootkit, malware-research, windows
Last push: 2026-05-22T00:18:47+00:00

## Health v2 (maintenance only)
Score: 58/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 83, release rhythm 8, longevity 89
- inputs: {"age_days": 1258, "days_push": 104, "days_rel": 691, "gap_med": null, "n_releases_24m": 1}
- flags: no_license
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1061, forks 162 (observed 2026-08-28T04:03:25.936368+00:00)

## What it is
Chaos-Rootkit is an x64 Ring 0 Windows kernel rootkit written in C++ as a research project to understand kernel internals and rootkit techniques. It demonstrates process hiding via DKOM, privilege elevation, driver swapping, file access restriction, and anti-malware bypass capabilities.

## Use cases
- study Windows kernel rootkit techniques
- learn DKOM process hiding internals
- research driver signature and integrity bypass methods
- understand process protection levels in Windows
- malware analysis and defense training
- explore kernel driver swapping techniques

## When to choose
- you are a security researcher studying rootkit internals
- you want to learn Windows kernel programming through real examples
- you are building defensive detections against rootkit techniques

## When to avoid
- you need production software or a supported tool
- you cannot legally or ethically use offensive kernel code
- you need a signed, stable driver for deployment
- you are not familiar with Windows kernel internals

## Facets
- artifact type: library
- maturity: active
- function: security, reverse-engineering
- domain: security, operating-systems, developer-tools
- platform: windows, cpp
- tags: rootkit, kernel-driver, windows-kernel, dkom, malware-research, ring-0, privilege-escalation, research

## Member repositories
- ZeroMemoryEx/Chaos-Rootkit (main) score 58

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:03:25.936368+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T06:56:49.163334+00:00, confidence not recorded.
  - readme: https://github.com/ZeroMemoryEx/Chaos-Rootkit (fetched 2026-08-28T04:03:25.936368+00:00, sha 8c570d50fcc7)
  - homepage: https://www.hackandhide.com/chaos-rootkit-internals-explained/ (fetched 2026-08-29T12:58:32.936143+00:00, sha a623f6a1de94)
  - site_page: https://www.hackandhide.com/about (fetched 2026-08-29T12:58:32.940511+00:00, sha 11bf68ecf21b)
  - site_page: https://www.hackandhide.com/cve-2025-68921 (fetched 2026-08-29T12:58:32.942182+00:00, sha 904fb830a446)
- Data as of 2026-08-30T08:39:29.467469+00:00.