Go to file
Jora Kornev 4c60797d4b
Merge pull request #42 from cha147/patch-1
fix typos in readme
2022-07-14 00:48:44 +03:00
Hidden Improved looking for EPROCESS::ActiveProcessLinks algo 2021-08-28 02:11:47 +03:00
Hidden Package Updated to WDK 10 and Windows 10 SDK 2021-01-21 02:48:11 +03:00
HiddenCLI Added an ability to configure hiding processes over a registry 2021-07-30 13:37:41 +03:00
HiddenLib Improvements for /query request 2021-07-29 16:53:39 +03:00
HiddenTests Added a test that validates hiding processes 2021-08-25 02:10:52 +03:00
.gitignore Memory leak fixes #2 (Verifier tests) 2017-01-30 22:41:24 +03:00
Hidden.sln HiddenCLI first steps 2016-12-04 22:27:46 +03:00
README.md fix typos in readme 2022-07-13 14:45:03 -07:00

Hidden 🇺🇦

Hidden has been developed like a solution for reverse engineering and researching tasks. This is a windows driver with a usermode interface which is used for hiding specific environment on your windows machine, like installed RCE programs (ex. procmon, wireshark), vm infrastructure (ex. vmware tools) and etc.


  • hide registry keys and values
  • hide files and directories
  • hide processes (experimental, might be not stable)
  • protect specific processes
  • exclude specific processes from hiding and protection features
  • usermode interface (lib and cli) for working with a driver

and so on

System requirements

Windows Vista and above, x86 and x64

  • Visual Studio 2019
  • Windows Driver Kit 10


Following guide explains how to make a release win32 build

  1. Open Hidden.sln using Visual Studio
  2. Build Hidden Package project with configurations Release, Win32
  3. Open build results folder <ProjectDir>\Release


  1. Disable a digital signature enforcement on a test machine (bcdedit /set TESTSIGNING ON) and reboot it
  2. Copy files from <ProjectDir>\Release\Hidden Package to a test machine
  3. Right mouse click on Hidden.inf and choose Install
  4. Start a driver (sc start hidden)
  5. Make sure service is running (sc query hidden)

Important: Keep in mind that the driver bitness have to be the same to an OS bitness


A command line tool hiddencli is used for managing a driver. You are able to use it for hiding and unhiding objects, changing a driver state and so on.

To hide a file try the command

hiddencli /hide file c:\Windows\System32\calc.exe

Want to hide a directory? No problems

hiddencli /hide dir "c:\Program Files\VMWare"

Registry key?

hiddencli /hide regkey "HKCU\Software\VMware, Inc."

Maybe a process?

hiddencli /hide pid 2340

By a process image name?

hiddencli /hide image apply:forall c:\Windows\Explorer.EXE

To get a full help just type

hiddencli /help