{"adoption": {"forks": 361, "observed_at": "2026-08-28T04:06:53.537230+00:00", "stars": 2463}, "canonical_url": "https://ross.abutalabs.com/products/nidhogg", "card": {"archived": false, "artifact_type": "library", "description": "Windows rootkit for Intel x64 with 25+ features, demonstrating rootkit techniques compatible with all Windows 10 and Windows 11 versions.", "domain": ["security", "penetration-testing", "operating-systems", "windows"], "enriched": true, "function": ["security", "penetration-testing", "reverse-engineering"], "health_score": 93, "homepage": "https://idov31.github.io/posts/lord-of-the-ring0-p1", "language": "C++", "license": "GPL-3.0", "license_family": "copyleft", "maturity": "active", "member_repos": ["Idov31/Nidhogg"], "name": "Idov31/Nidhogg", "platform": ["windows", "cpp"], "pushed_at": "2026-06-26T10:50:49+00:00", "repo": "Idov31/Nidhogg", "stars": 2463, "tags": ["rootkit", "kernel-driver", "red-team", "windows-kernel", "offensive-security", "edr-evasion", "credential-dumping", "process-hiding"], "topics": ["cpp", "cybersecurity", "infosec", "kernel", "red-team", "redteam", "rootkit", "windows", "windows-rootkits", "cyber-security", "driver"], "urls": [], "use_cases": ["hide processes and threads from user-mode tools on windows", "bypass AMSI and ETW during red team operations", "inject shellcode or DLLs via APC or NtCreateThreadEx", "remove or restore kernel callbacks to evade EDR", "dump credentials from kernel space", "learn windows kernel rootkit techniques", "protect files and registry keys from deletion", "reflectively load a kernel driver with kdmapper"], "what_it_is": "Nidhogg is an open-source Windows x64 kernel rootkit written in C++ that demonstrates a wide range of rootkit techniques such as process, thread, file, registry, and port hiding, kernel callback manipulation, AMSI/ETW patching, and shellcode/DLL injection. It consists of a kernel driver and a user-mode C++ controller, compatible with all Windows 10 and 11 versions and designed for red team operations and security research.", "when_to_avoid": ["you need a defensive or production security tool", "you cannot tolerate blue screens or system instability", "you need support for 32-bit or non-Windows platforms", "your use case requires stealth from PatchGuard when registering callbacks via reflective loading"], "when_to_choose": ["you need an all-in-one, well-documented windows rootkit for red team engagements", "you are researching or teaching windows kernel rootkit techniques", "you want a kernel driver that integrates with your C2 framework", "you need to test EDR/AV detection against kernel-level evasion"]}, "data_as_of": "2026-08-30T08:39:29.467469+00:00", "members": [{"path": "/products/nidhogg", "repo": "Idov31/Nidhogg", "role": "main", "score": 83}], "provenance": {"archived": {"kind": "observed", "observed_at": "2026-08-28T04:06:53.537230+00:00", "source": "github"}, "artifact_type": {"confidence": null, "enriched_at": "2026-08-30T02:29:16.658671+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "50a7d9e453a7fd9c12ab23049259f39f53978c82a5797b09963ad3999a6720a1", "fetched_at": "2026-08-28T04:06:53.537230+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Idov31/Nidhogg"}, {"content_hash": "59ad8f9e8e99a8b36db4da3ed2dd9c46108d01a56219f01823d86dd4b4e3ec95", "fetched_at": "2026-08-29T10:10:47.133436+00:00", "kind": "homepage", "missing": false, "url": "https://idov31.github.io/posts/lord-of-the-ring0-p1"}], "taxonomy_version": 1}, "description": {"kind": "observed", "observed_at": "2026-08-28T04:06:53.537230+00:00", "source": "github"}, "domain": {"confidence": null, "enriched_at": "2026-08-30T02:29:16.658671+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "50a7d9e453a7fd9c12ab23049259f39f53978c82a5797b09963ad3999a6720a1", "fetched_at": "2026-08-28T04:06:53.537230+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Idov31/Nidhogg"}, {"content_hash": "59ad8f9e8e99a8b36db4da3ed2dd9c46108d01a56219f01823d86dd4b4e3ec95", "fetched_at": "2026-08-29T10:10:47.133436+00:00", "kind": "homepage", "missing": false, "url": "https://idov31.github.io/posts/lord-of-the-ring0-p1"}], "taxonomy_version": 1}, "enriched": {"inputs": [], "kind": "computed", "method": "enrichment_status"}, "function": {"confidence": null, "enriched_at": "2026-08-30T02:29:16.658671+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "50a7d9e453a7fd9c12ab23049259f39f53978c82a5797b09963ad3999a6720a1", "fetched_at": "2026-08-28T04:06:53.537230+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Idov31/Nidhogg"}, {"content_hash": "59ad8f9e8e99a8b36db4da3ed2dd9c46108d01a56219f01823d86dd4b4e3ec95", "fetched_at": "2026-08-29T10:10:47.133436+00:00", "kind": "homepage", "missing": false, "url": "https://idov31.github.io/posts/lord-of-the-ring0-p1"}], "taxonomy_version": 1}, "health_score": {"inputs": ["days_since_push", "days_since_release", "archived"], "kind": "computed", "method": "health_v1"}, "homepage": {"kind": "observed", "observed_at": "2026-08-28T04:06:53.537230+00:00", "source": "github"}, "language": {"kind": "observed", "observed_at": "2026-08-28T04:06:53.537230+00:00", "source": "github"}, "license": {"kind": "observed", "observed_at": "2026-08-28T04:06:53.537230+00:00", "source": "github"}, "license_family": {"inputs": ["license"], "kind": "computed", "method": "license_family"}, "maturity": {"confidence": null, "enriched_at": "2026-08-30T02:29:16.658671+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "50a7d9e453a7fd9c12ab23049259f39f53978c82a5797b09963ad3999a6720a1", "fetched_at": "2026-08-28T04:06:53.537230+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Idov31/Nidhogg"}, {"content_hash": "59ad8f9e8e99a8b36db4da3ed2dd9c46108d01a56219f01823d86dd4b4e3ec95", "fetched_at": "2026-08-29T10:10:47.133436+00:00", "kind": "homepage", "missing": false, "url": "https://idov31.github.io/posts/lord-of-the-ring0-p1"}], "taxonomy_version": 1}, "member_repos": {"kind": "observed", "observed_at": "2026-08-28T04:06:53.537230+00:00", "source": "github"}, "name": {"kind": "observed", "observed_at": "2026-08-28T04:06:53.537230+00:00", "source": "github"}, "platform": {"confidence": null, "enriched_at": "2026-08-30T02:29:16.658671+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "50a7d9e453a7fd9c12ab23049259f39f53978c82a5797b09963ad3999a6720a1", "fetched_at": "2026-08-28T04:06:53.537230+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Idov31/Nidhogg"}, {"content_hash": "59ad8f9e8e99a8b36db4da3ed2dd9c46108d01a56219f01823d86dd4b4e3ec95", "fetched_at": "2026-08-29T10:10:47.133436+00:00", "kind": "homepage", "missing": false, "url": "https://idov31.github.io/posts/lord-of-the-ring0-p1"}], "taxonomy_version": 1}, "pushed_at": {"kind": "observed", "observed_at": "2026-08-28T04:06:53.537230+00:00", "source": "github"}, "repo": {"kind": "observed", "observed_at": "2026-08-28T04:06:53.537230+00:00", "source": "github"}, "stars": {"kind": "observed", "observed_at": "2026-08-28T04:06:53.537230+00:00", "source": "github"}, "tags": {"confidence": null, "enriched_at": "2026-08-30T02:29:16.658671+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "50a7d9e453a7fd9c12ab23049259f39f53978c82a5797b09963ad3999a6720a1", "fetched_at": "2026-08-28T04:06:53.537230+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Idov31/Nidhogg"}, {"content_hash": "59ad8f9e8e99a8b36db4da3ed2dd9c46108d01a56219f01823d86dd4b4e3ec95", "fetched_at": "2026-08-29T10:10:47.133436+00:00", "kind": "homepage", "missing": false, "url": "https://idov31.github.io/posts/lord-of-the-ring0-p1"}], "taxonomy_version": 1}, "topics": {"kind": "observed", "observed_at": "2026-08-28T04:06:53.537230+00:00", "source": "github"}, "urls": {"kind": "observed", "observed_at": "2026-08-28T04:06:53.537230+00:00", "source": "github"}, "use_cases": {"confidence": null, "enriched_at": "2026-08-30T02:29:16.658671+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "50a7d9e453a7fd9c12ab23049259f39f53978c82a5797b09963ad3999a6720a1", "fetched_at": "2026-08-28T04:06:53.537230+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Idov31/Nidhogg"}, {"content_hash": "59ad8f9e8e99a8b36db4da3ed2dd9c46108d01a56219f01823d86dd4b4e3ec95", "fetched_at": "2026-08-29T10:10:47.133436+00:00", "kind": "homepage", "missing": false, "url": "https://idov31.github.io/posts/lord-of-the-ring0-p1"}], "taxonomy_version": 1}, "what_it_is": {"confidence": null, "enriched_at": "2026-08-30T02:29:16.658671+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "50a7d9e453a7fd9c12ab23049259f39f53978c82a5797b09963ad3999a6720a1", "fetched_at": "2026-08-28T04:06:53.537230+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Idov31/Nidhogg"}, {"content_hash": "59ad8f9e8e99a8b36db4da3ed2dd9c46108d01a56219f01823d86dd4b4e3ec95", "fetched_at": "2026-08-29T10:10:47.133436+00:00", "kind": "homepage", "missing": false, "url": "https://idov31.github.io/posts/lord-of-the-ring0-p1"}], "taxonomy_version": 1}, "when_to_avoid": {"confidence": null, "enriched_at": "2026-08-30T02:29:16.658671+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "50a7d9e453a7fd9c12ab23049259f39f53978c82a5797b09963ad3999a6720a1", "fetched_at": "2026-08-28T04:06:53.537230+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Idov31/Nidhogg"}, {"content_hash": "59ad8f9e8e99a8b36db4da3ed2dd9c46108d01a56219f01823d86dd4b4e3ec95", "fetched_at": "2026-08-29T10:10:47.133436+00:00", "kind": "homepage", "missing": false, "url": "https://idov31.github.io/posts/lord-of-the-ring0-p1"}], "taxonomy_version": 1}, "when_to_choose": {"confidence": null, "enriched_at": "2026-08-30T02:29:16.658671+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "50a7d9e453a7fd9c12ab23049259f39f53978c82a5797b09963ad3999a6720a1", "fetched_at": "2026-08-28T04:06:53.537230+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Idov31/Nidhogg"}, {"content_hash": "59ad8f9e8e99a8b36db4da3ed2dd9c46108d01a56219f01823d86dd4b4e3ec95", "fetched_at": "2026-08-29T10:10:47.133436+00:00", "kind": "homepage", "missing": false, "url": "https://idov31.github.io/posts/lord-of-the-ring0-p1"}], "taxonomy_version": 1}}, "score": {"components": {"activity": 89, "longevity": 100, "rhythm": 66}, "computed_at": "2026-09-02T17:46:02.011165+00:00", "flags": [], "formula": "round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)", "inputs": {"age_days": 1557, "days_push": 68, "days_rel": 68, "gap_med": 132.5, "n_releases_24m": 3}, "score": 83, "version": 2}, "staleness": {"enrichment_outdated": false, "low_confidence": false, "scrape_days": 9, "stale_scrape": false}}