iPower/KasperskyHook

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

1314 stars · 284 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A Windows research project that hooks system calls by loading Kaspersky's hypervisor driver (klhk.sys) and a custom kernel driver that subverts its syscall dispatch table. It demonstrates hijacking IA32_LSTAR-based syscall handling via a third-party hypervisor.

Use cases

• hook system calls on Windows via a hypervisor
• research how Kaspersky's hypervisor dispatches syscalls
• build a custom syscall hooking driver
• study IA32_LSTAR and KiSystemCall64 hooking techniques
• experiment with VT-x based kernel hooking on bare metal

When to choose

• you are researching hypervisor-based syscall hooking on Windows
• you want to experiment with Kaspersky's klhk.sys driver internals
• you need a working example of kernel-mode syscall interception

When to avoid

• you need a production or stable hooking solution
• you run inside a VM or with Hyper-V/VBS enabled
• you cannot run on bare metal with hardware virtualization
• you need support for all Windows builds without driver version matching

Facets

library · maturity experimental

security reverse-engineering developer-tools security reverse-engineering operating-systems windows windows cpp syscall-hooking hypervisor kernel-driver rootkit-research vt-x klhk

Member repositories

For agents

markdown · JSON · MCP: product_card(name="iPower/KasperskyHook")