RK25 is a kernel-mode rootkit driver designed to dynamically adapt to various Windows versions through syscall table hooking and memory management techniques. Built as a WDM driver, it provides stealth capabilities while maintaining compatibility across major Windows updates.
graph TD;
A[RK25 Core] o--o B[Hooking]
A o--o E[Command Dispatcher]
A o--o F[Kernel Searcher]
A o--o G[OS Version Switcher]
E-->H[IOCTL]
B-->C[Syscall Hooking]
B-->D[Network Hooking]
K[EntryPoint]-->|init|F
- Automatic OS Version Detection
- Process hiding
- Process privilege escalation
- Network connection hiding
- ... and something in development :D
- WDK/SDK
- Visual Studio (driver)
- Golang (manager)
- WinDBG
- OS Windows VM (VMWare etc)
MIT License - see LICENSE for details