# AxtMueller/Windows-Kernel-Explorer

A free but powerful Windows kernel research tool.

Repository: https://github.com/AxtMueller/Windows-Kernel-Explorer
Canonical: https://ross.abutalabs.com/products/windows-kernel-explorer
Homepage: https://github.com/AxtMueller/Windows-Kernel-Explorer#contact
License Family: other
Topics: windows, kernel, driver, debugger, wke, win64ast, pchunter, ark
Last push: 2025-12-14T04:44:06+00:00

## Health v2 (maintenance only)
Score: 58/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 57, release rhythm 35, longevity 100
- inputs: {"age_days": 2838, "days_push": 262, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases, no_license
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 2717, forks 580 (observed 2026-08-28T04:07:12.179505+00:00)

## What it is
Windows Kernel Explorer (WKE) is a free Windows kernel research and inspection tool supporting Windows XP through Windows 11. It loads a kernel driver to inspect system internals and stays compatible with new Windows builds by downloading symbol files and DAT data rather than requiring binary updates.

## Use cases
- inspect windows kernel objects and drivers
- detect hidden processes and rootkits on windows
- alternative to pchunter and win64ast
- research windows internals on windows 11
- unload suspicious kernel drivers
- analyze malware kernel hooks

## When to choose
- you need an ARK-style kernel inspection tool that keeps working on the latest Windows releases without updates
- you want a free PCHunter/WIN64AST successor supporting XP through Windows 11

## When to avoid
- you need a signed, AV-trusted tool for production environments - its drivers use a leaked certificate and trigger antivirus flags
- you cannot disable HVCI/Secure Boot or whitelist the driver, since driver loading may fail
- you are not comfortable running a kernel driver on your system

## Facets
- artifact type: application
- maturity: active
- function: security, reverse-engineering, developer-tools
- domain: security, operating-systems, reverse-engineering, windows
- platform: windows
- tags: kernel-debugger, ark-tool, rootkit-detection, windows-kernel, driver, pchunter-alternative, sysinternals-like, debugging

## Member repositories
- AxtMueller/Windows-Kernel-Explorer (main) score 58

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:07:12.179505+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T02:15:19.838224+00:00, confidence not recorded.
  - readme: https://github.com/AxtMueller/Windows-Kernel-Explorer (fetched 2026-08-28T04:07:12.179505+00:00, sha 66a0e1485d51)
  - homepage: https://github.com/AxtMueller/Windows-Kernel-Explorer#contact (fetched 2026-08-29T09:58:41.056544+00:00, sha 471298bbf84d)
- Data as of 2026-08-30T08:39:29.467469+00:00.