Stealth-focused kernel module resolver with zero PE imports

• 🎯 Zero PE Imports - Only PsLoadedModuleList is imported, everything else is dynamically resolved
• 🕵️ Stealth First - Designed for minimal detection footprint
• ⚡ Lightweight - Header-only, no external dependencies
• 🔧 Universal - Works with any kernel module (ntoskrnl, win32k, CI.dll, etc.)
• 📦 No CRT Required - Custom string functions, no runtime dependencies
• 🚀 High Performance - Everything is __forceinline

• Windows 10 / 11 (x64)
• Visual Studio 2022+
• WDK (Windows Driver Kit)

Simply copy nox.hpp and nt.hpp to your project:

project/
├── nox.hpp    # base class for any module
├── nt.hpp     # ntoskrnl specialization
└── driver.cpp # your code

#include "nt.hpp"

NTSTATUS DriverEntry(PDRIVER_OBJECT driver_obj, PUNICODE_STRING reg_path)
{
    PVOID current_process = nt.ps_get_current_process();
    PVOID peb = nt.ps_get_process_peb(current_process);
    
    // use macro for cleaner code
    PVOID proc = NT_CALL(PsGetCurrentProcess);
    
    // force TLB invalidation and cache flush across all processors
    nt.flush_caches(proc);
    
    return STATUS_SUCCESS;
}