Cronos is Windows 10/11 x64 ring 0 rootkit. Cronos is able to hide processes, protect and elevate them with token manipulation.
-
Updated
Mar 29, 2022 - C++
#
ring0
Here are 44 public repositories matching this topic...
Experimental Windows x64 Kernel Rootkit with anti-rootkit evasion features.
-
Updated
Aug 2, 2025 - C++
Linux Loadable Kernel Module (LKM) based rootkit (ring-0), capable of hiding itself, processes/implants, rmmod proof, has ability to bypass infamous rkhunter antirootkit.
c linux security backdoor malware linux-kernel ring0 linux-kernel-module hacktoberfest hacking-tool security-tools redteam linux-device-driver redteam-tools post-exploitation-toolkit kernel-mode-rootkit antirootkit-bypass rkhunter-antirootkit
-
Updated
Dec 6, 2025 - C
Kernel Detective
-
Updated
May 24, 2026 - C
🐧 Assembly with Linux (Notes, Syscalls, Protection Rings) 🐧
linux kernel-module assembly read linux-kernel write kernel-mode syscalls nasm ring0 usermode nasm-assembly systemcalls ring3 systemcall ring-0 ring-3 privileged-instruction protection-ring privilege-levels
-
Updated
Feb 29, 2024 - Assembly
Basic interactive Windows kernel offensive toolkit written in C
-
Updated
Sep 20, 2025 - C++
Windows BYOVD research on DCRCVDrv.sys and Alinubx.sys, reverse engineering their kernel primitives, IOCTL surfaces, and detection opportunities.
reverse-engineering antivirus kernel-mode ring0 kernel-exploitation ioctl edr av-bypass windows-internals windows-security edr-evasion threatresearch byovd windows-exploit kernel-security process-termination vulnerable-driver av-killer edr-killer driver-security
-
Updated
Sep 15, 2026 - Rust
Add this topic to your repo
To associate your repository with the ring0 topic, visit your repo's landing page and select "manage topics."