# JKornev/hidden

🇺🇦 Windows driver with usermode interface which can hide processes, file-system and registry objects, protect processes and etc

Repository: https://github.com/JKornev/hidden
Canonical: https://ross.abutalabs.com/products/jkornev-hidden
Language: C
License Family: other
Topics: windows, security, malware-analysis, registry, driver, kernel, rootkit, rce
Last push: 2022-07-13T21:48:44+00:00

## Health v2 (maintenance only)
Score: 23/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 0, release rhythm 8, longevity 100
- inputs: {"age_days": 3730, "days_push": 1512, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_license
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 2051, forks 505 (observed 2026-08-28T04:06:09.601398+00:00)

## What it is
A Windows kernel driver with a usermode library and CLI that can hide processes, files, directories, and registry keys, and protect processes from observation. It is intended for reverse engineering and research tasks such as concealing analysis tools or VM infrastructure on a test machine.

## Use cases
- hide files and registry keys from other processes on windows
- hide a process by pid or image name
- protect a process from being killed or inspected
- conceal reverse engineering tools like procmon or wireshark on a test vm
- research windows kernel rootkit techniques
- manage kernel object hiding from a command line

## When to choose
- you need a research driver to hide files, registry keys, or processes on windows
- you are studying rootkit-style kernel techniques in a controlled test environment
- you want a CLI and library interface to a hiding driver

## When to avoid
- you need a production or signed security product - it requires test signing and has no license
- you want defensive anti-malware or EDR functionality
- you need stable process hiding - it is marked experimental
- you are not comfortable loading kernel drivers on a test machine

## Facets
- artifact type: library
- maturity: maintenance
- function: security, reverse-engineering
- domain: security, windows, reverse-engineering
- platform: windows, cli
- tags: kernel-driver, rootkit, process-hiding, registry-hiding, file-hiding, usermode-interface, malware-analysis

## Member repositories
- JKornev/hidden (main) score 23

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:06:09.601398+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T02:57:30.538548+00:00, confidence not recorded.
  - readme: https://github.com/JKornev/hidden (fetched 2026-08-28T04:06:09.601398+00:00, sha f5ecc5717617)
- Data as of 2026-08-30T08:39:29.467469+00:00.