{"adoption": {"forks": 343, "observed_at": "2026-08-28T04:04:36.853299+00:00", "stars": 1398}, "canonical_url": "https://ross.abutalabs.com/products/ddimon", "card": {"archived": false, "artifact_type": "library", "description": "Monitoring and controlling kernel API calls with stealth hook using EPT", "domain": ["security", "reverse-engineering", "operating-systems", "developer-tools"], "enriched": true, "function": ["security", "reverse-engineering", "monitoring"], "health_score": 20, "homepage": null, "language": "C++", "license": "MIT", "license_family": "permissive", "maturity": "maintenance", "member_repos": ["tandasat/DdiMon"], "name": "tandasat/DdiMon", "platform": ["windows", "cpp"], "pushed_at": "2022-01-22T16:31:24+00:00", "repo": "tandasat/DdiMon", "stars": 1398, "tags": ["hypervisor", "ept", "stealth-hooking", "patchguard", "kernel-driver", "memory-shadowing", "hyperplatform", "educational"], "topics": [], "urls": [], "use_cases": ["monitor kernel API calls without being detected by PatchGuard", "hide processes from NtQuerySystemInformation invisibly", "learn how to program with Intel EPT and memory shadowing", "research stealth hooking techniques on x64 Windows", "intercept DDI calls like ExAllocatePoolWithTag and ExQueueWorkItem"], "what_it_is": "DdiMon is a hypervisor-based research tool that performs stealth inline hooking of Windows kernel API calls using Intel VT-x EPT memory shadowing, making hooks invisible to guests and PatchGuard. It is built on HyperPlatform and serves as an educational resource for programming with EPT.", "when_to_avoid": ["you need a production-ready or actively maintained monitoring solution", "your system lacks Intel VT-x and EPT support", "you need hooks on non-Windows platforms or user-mode APIs", "you cannot enable test signing for kernel drivers"], "when_to_choose": ["you need kernel API hooks invisible to PatchGuard and guest memory reads", "you want a practical educational example of EPT-based hypervisor programming on Windows", "you are researching stealth monitoring of kernel driver interfaces"]}, "data_as_of": "2026-08-30T08:39:29.467469+00:00", "members": [{"path": "/products/ddimon", "repo": "tandasat/DdiMon", "role": "main", "score": 32}], "provenance": {"archived": {"kind": "observed", "observed_at": "2026-08-28T04:04:36.853299+00:00", "source": "github"}, "artifact_type": {"confidence": null, "enriched_at": "2026-08-30T04:39:14.741185+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "6cc51b6a585533fcd1b78db695b1b3c1fa3b00afd05a898fef144b6eaeec269b", "fetched_at": "2026-08-28T04:04:36.853299+00:00", "kind": "readme", "missing": false, "url": "https://github.com/tandasat/DdiMon"}], "taxonomy_version": 1}, "description": {"kind": "observed", "observed_at": "2026-08-28T04:04:36.853299+00:00", "source": "github"}, "domain": {"confidence": null, "enriched_at": "2026-08-30T04:39:14.741185+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "6cc51b6a585533fcd1b78db695b1b3c1fa3b00afd05a898fef144b6eaeec269b", "fetched_at": "2026-08-28T04:04:36.853299+00:00", "kind": "readme", "missing": false, "url": "https://github.com/tandasat/DdiMon"}], "taxonomy_version": 1}, "enriched": {"inputs": [], "kind": "computed", "method": "enrichment_status"}, "function": {"confidence": null, "enriched_at": "2026-08-30T04:39:14.741185+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "6cc51b6a585533fcd1b78db695b1b3c1fa3b00afd05a898fef144b6eaeec269b", "fetched_at": "2026-08-28T04:04:36.853299+00:00", "kind": "readme", "missing": false, "url": "https://github.com/tandasat/DdiMon"}], "taxonomy_version": 1}, "health_score": {"inputs": ["days_since_push", "days_since_release", "archived"], "kind": "computed", "method": "health_v1"}, "homepage": {"kind": "observed", "observed_at": "2026-08-28T04:04:36.853299+00:00", "source": "github"}, "language": {"kind": "observed", "observed_at": "2026-08-28T04:04:36.853299+00:00", "source": "github"}, "license": {"kind": "observed", "observed_at": "2026-08-28T04:04:36.853299+00:00", "source": "github"}, "license_family": {"inputs": ["license"], "kind": "computed", "method": "license_family"}, "maturity": {"confidence": null, "enriched_at": "2026-08-30T04:39:14.741185+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "6cc51b6a585533fcd1b78db695b1b3c1fa3b00afd05a898fef144b6eaeec269b", "fetched_at": "2026-08-28T04:04:36.853299+00:00", "kind": "readme", "missing": false, "url": "https://github.com/tandasat/DdiMon"}], "taxonomy_version": 1}, "member_repos": {"kind": "observed", "observed_at": "2026-08-28T04:04:36.853299+00:00", "source": "github"}, "name": {"kind": "observed", "observed_at": "2026-08-28T04:04:36.853299+00:00", "source": "github"}, "platform": {"confidence": null, "enriched_at": "2026-08-30T04:39:14.741185+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "6cc51b6a585533fcd1b78db695b1b3c1fa3b00afd05a898fef144b6eaeec269b", "fetched_at": "2026-08-28T04:04:36.853299+00:00", "kind": "readme", "missing": false, "url": "https://github.com/tandasat/DdiMon"}], "taxonomy_version": 1}, "pushed_at": {"kind": "observed", "observed_at": "2026-08-28T04:04:36.853299+00:00", "source": "github"}, "repo": {"kind": "observed", "observed_at": "2026-08-28T04:04:36.853299+00:00", "source": "github"}, "stars": {"kind": "observed", "observed_at": "2026-08-28T04:04:36.853299+00:00", "source": "github"}, "tags": {"confidence": null, "enriched_at": "2026-08-30T04:39:14.741185+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "6cc51b6a585533fcd1b78db695b1b3c1fa3b00afd05a898fef144b6eaeec269b", "fetched_at": "2026-08-28T04:04:36.853299+00:00", "kind": "readme", "missing": false, "url": "https://github.com/tandasat/DdiMon"}], "taxonomy_version": 1}, "topics": {"kind": "observed", "observed_at": "2026-08-28T04:04:36.853299+00:00", "source": "github"}, "urls": {"kind": "observed", "observed_at": "2026-08-28T04:04:36.853299+00:00", "source": "github"}, "use_cases": {"confidence": null, "enriched_at": "2026-08-30T04:39:14.741185+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "6cc51b6a585533fcd1b78db695b1b3c1fa3b00afd05a898fef144b6eaeec269b", "fetched_at": "2026-08-28T04:04:36.853299+00:00", "kind": "readme", "missing": false, "url": "https://github.com/tandasat/DdiMon"}], "taxonomy_version": 1}, "what_it_is": {"confidence": null, "enriched_at": "2026-08-30T04:39:14.741185+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "6cc51b6a585533fcd1b78db695b1b3c1fa3b00afd05a898fef144b6eaeec269b", "fetched_at": "2026-08-28T04:04:36.853299+00:00", "kind": "readme", "missing": false, "url": "https://github.com/tandasat/DdiMon"}], "taxonomy_version": 1}, "when_to_avoid": {"confidence": null, "enriched_at": "2026-08-30T04:39:14.741185+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "6cc51b6a585533fcd1b78db695b1b3c1fa3b00afd05a898fef144b6eaeec269b", "fetched_at": "2026-08-28T04:04:36.853299+00:00", "kind": "readme", "missing": false, "url": "https://github.com/tandasat/DdiMon"}], "taxonomy_version": 1}, "when_to_choose": {"confidence": null, "enriched_at": "2026-08-30T04:39:14.741185+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "6cc51b6a585533fcd1b78db695b1b3c1fa3b00afd05a898fef144b6eaeec269b", "fetched_at": "2026-08-28T04:04:36.853299+00:00", "kind": "readme", "missing": false, "url": "https://github.com/tandasat/DdiMon"}], "taxonomy_version": 1}}, "score": {"components": {"activity": 0, "longevity": 100, "rhythm": 35}, "computed_at": "2026-09-02T17:46:02.011165+00:00", "flags": ["no_releases"], "formula": "round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)", "inputs": {"age_days": 3816, "days_push": 1684, "days_rel": null, "gap_med": null, "n_releases_24m": 0}, "score": 32, "version": 2}, "staleness": {"enrichment_outdated": false, "low_confidence": false, "scrape_days": 9, "stale_scrape": false}}