2016-08-27 21:04:21 +00:00
# Hidden
2019-08-22 16:09:28 +00:00
This toolset is developed like a solution for my reverse engineering and researching tasks. This is a windows driver with a usermode interface which is used for hidding specific environment on VMs, like installed rce programs (ex. procmon, wireshark), vm infrastracture (ex. vmware tools) and etc.
2016-08-27 21:04:21 +00:00
2017-02-02 23:17:24 +00:00
**Features**
2016-08-27 21:04:21 +00:00
- hide registry keys and values
- hide files and directories
- protect specific processes using ObRegisterCallbacks
- exclude specific processes from hidding and protection features
- usermode interface (lib and cli) for working with driver
2016-08-27 21:04:49 +00:00
2016-08-27 21:04:21 +00:00
and so on
2017-02-01 14:13:07 +00:00
2017-02-02 23:17:24 +00:00
**Recommended build environment**
2017-02-02 23:01:37 +00:00
- Visual Studio 2013 and above
- Windows Driver Kit 8.1
2019-08-22 16:09:28 +00:00
**Building**
Following guide explains how to make a release win32 build
1. Open Hidden.sln using Visual Studio 2013
2. Build **Hidden Package** project with configurations Release, Win32
2019-08-22 17:20:25 +00:00
3. Open build results folder ** \<ProjectDir\>\Release**
2019-08-22 16:09:28 +00:00
**Installing**
2019-08-22 16:10:14 +00:00
1. Disable a digital signature enforcement on a test machine (bcdedit /set TESTSIGNING ON)
2019-08-22 17:20:25 +00:00
2. Copy files from ** \<ProjectDir\>\Release\Hidden Package** to a test machine
2019-08-22 16:10:14 +00:00
3. Right mouse click on **Hidden.inf** and choose **Install**
4. Start a driver (sc start hidden)
