This wiki documents Nidhogg version 2.0.0. It explains how the current driver and NidhoggClient.exe interface expose each feature, and notes version-specific limitations where they matter.

Nidhogg is a multi-functional Windows kernel research project. It contains a WDM kernel driver and a C++ client that communicates with the driver through IOCTLs. Its features cover process, thread, file, registry, memory, network, callback, ETW-TI, and Nidhogg Object File (NOF) operations.

All current features are documented for x64 Windows 10 and Windows 11, with the source repository stating testing through Windows 11 25H2.

Nidhogg was built primarily for giving inspiration to others, but over time it grew bigger and its interface changed several times. Nidhogg contains all of its features in one driver and is controlled through IOCTLs, as implemented in the provided client. The features can be divided into three categories:

• Continuous Operation: A feature that runs in the background consistently (for example: object / registry callbacks).
• Semi Continuous Operation: A feature that is not running when the driver is loaded but starts after a user request and continues until driver unload or explicit cancellation (for example: IRP hooking).
• Immediate Operation: An operation with a short lifespan that returns an immediate response (for example: disabling ETW-TI).

NidhoggClient.exe currently exposes the following handlers:

• process
• thread
• file
• registry
• memory
• network
• anti_analysis

Commands can be run interactively by starting NidhoggClient.exe, choosing a handler, and then entering a handler command. They can also be run directly as:

NidhoggClient.exe <handler> "<handler command and arguments>"

For example:

NidhoggClient.exe process "hide <PID>"
NidhoggClient.exe memory "load_nof <NOF path> <entrypoint name> [parameter]"