wbenny/injdrv

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

1296 stars · 299 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A proof-of-concept Windows kernel driver that injects DLLs into user-mode processes using Asynchronous Procedure Calls (APC). It hooks into process and image load notifications to inject early in process initialization, with a demonstrative DLL that hooks ntdll functions and traces calls via ETW.

Use cases

• inject a DLL into a user-mode process from a kernel driver
• learn how APC-based DLL injection works on Windows
• hook ntdll functions in newly created processes
• inject DLLs into Wow64 processes on x64 Windows
• study Windows kernel driver development with process callbacks
• trace API calls using ETW from an injected DLL

When to choose

• you need a small, readable reference implementation of kernel-mode APC DLL injection
• you want to inject DLLs very early in process initialization
• you need support for x86, x64, ARM32, ARM64 and Wow64 injection
• you are researching Windows internals or building security/monitoring tooling

When to avoid

• you need a production-ready, supported injection solution
• you want user-mode-only injection without a kernel driver
• you need documentation beyond a proof-of-concept or long-term maintenance guarantees
• your target is Windows 11 or newer (support is stated for Windows 7 through 10)

Facets

library · maturity maintenance

security reverse-engineering developer-tools security windows reverse-engineering developer-tools windows cpp c windows-driver dll-injection apc kernel-driver hooking proof-of-concept wow64 etw-tracing

Member repositories

For agents

markdown · JSON · MCP: product_card(name="wbenny/injdrv")