# ClownQq/YDArk

X64内核小工具

Repository: https://github.com/ClownQq/YDArk
Canonical: https://ross.abutalabs.com/products/ydark
License Family: other
Topics: pchunter, win64ast
Last push: 2024-01-18T05:31:40+00:00

## Health v2 (maintenance only)
Score: 32/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 0, release rhythm 35, longevity 100
- inputs: {"age_days": 2521, "days_push": 958, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases, no_license
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1375, forks 229 (observed 2026-08-28T04:04:33.157920+00:00)

## What it is
YDArk is a free x64 Windows kernel inspection tool similar to PCHunter, providing GUI views of processes, threads, handles, drivers, kernel hooks (SSDT, IDT, filters), and network state. It is aimed at learning and system research, with an unsigned VMProtect-packed driver that requires test signing or debug mode.

## Use cases
- inspect and kill hidden processes and threads on windows x64
- detect and restore ssdt and kernel hooks
- view and unload kernel drivers including hidden ones
- dump process memory and modules
- enumerate system notify callbacks and dpc timers
- analyze filter drivers and file system hooks
- view open handles and network ports

## When to choose
- you need a PCHunter-style kernel inspector for 64-bit windows
- you are researching rootkits, hooks, or kernel callbacks
- you want to dump drivers or restore patched kernel tables

## When to avoid
- you need a signed production tool or kernel isolation (HVCI) compatibility
- you cannot disable Secure Boot or enable test signing
- you need a license for commercial use

## Facets
- artifact type: application
- maturity: active
- function: security, reverse-engineering, developer-tools, gui
- domain: security, reverse-engineering, windows, developer-tools
- platform: windows
- tags: kernel-tools, rootkit-detection, system-internals, x64, pchunter-alternative, driver-inspection, desktop

## Member repositories
- ClownQq/YDArk (main) score 32

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:33.157920+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T04:40:32.872625+00:00, confidence not recorded.
  - readme: https://github.com/ClownQq/YDArk (fetched 2026-08-28T04:04:33.157920+00:00, sha 396c4089b8cd)
- Data as of 2026-08-30T08:39:29.467469+00:00.