Windows Kernel Explorer (you can simply call it as "WKE") is a free but powerful kernel research tool. It supports from Windows XP to Windows 10 (32-bit and 64-bit). Compared to WIN64AST and PCHunter, WKE can run on the latest Windows 10 without updating binary files.
WKE will automatically download required symbol files if the current system is not supported natively, 90% of the features will work after this step. For some needed data that doesn't exist in symbol files, WKE will try to retrieve them from the DAT file (when new Windows 10 releases, I will upload a new DAT file to GitHub). If WKE cannot access the internet, 50% of the features will still work. Currently, native support is available from Windows XP to Windows 10 RS3, Windows 10 from RS4 to 20H1 are fully supported by parsing symbol files and DAT file.
You can customize WKE by editing the configuration file. Currently, you can specify the device name and symbolic link name of driver, and altitude of filter. You can also enable kernel-mode and user-mode characteristics randomization to avoid being detected by malware. If you rename the EXE file of WKE, then you need to rename SYS/DAT/INI files together with the same name.
Because I don't have a digital certificate, I have to use the leaked digital certificate from HT SRL to sign drivers of WKE. I use "DSEFIX" as an alternative solution to bypass DSE, you can try to launch WKE with "WKE_dsefix.bat" if WKE loads driver unsuccessfully on your system. Signing files with the HT SRL digital certificate has a side effect: almost all Anti-Virus software infer files with HT SRL digital signature are malware, because many hackers use it to sign malwares since 2015. Only idiots implant malicious code into a tool for experienced programmers and reverse engineers, because most users only use WKE in test environments, this kind of behavior is meaningless.
- Secure boot is enabled.
- Anti-Virus software prevents the driver from loading.
- Disable secure boot.
- Add the files of WKE to the white list of Anti-Virus software.
It is a bit awkward, so I say straightforwardly: I don't plan to share the source code of this tool, but I may share some source code of test programs that associated with this tool.
I received too many SPAM of this issue. I must declare: WKE is not designed to bypass any Anti-Cheat solution. If you need to use WKE in a specfic environment, please order "binary customization" service.
- Process management (Module, Thread, Handle, Memory, Window, Windows Hook, etc.)
- File management (NTFS partition analysis, low-level disk access, etc.)
- Registry management and HIVE file operation
- Kernel-mode callback, filter, timer, NDIS blocks and WFP callout functions management
- Kernel-mode hook scanning (MSR, EAT, IAT, CODE PATCH, SSDT, SSSDT, IDT, IRP, OBJECT)
- User-mode hook scanning (Kernel Callback Table, EAT, IAT, CODE PATCH)
- Memory editor and symbol parser (it looks like a simplified version of WINDBG)
- Hide driver, hide/protect process, hide/protect/redirect file or directory, protect registry and falsify registry data
- Path modification for driver, process and process module
- Enable/disable some obnoxious Windows components
In order to optimize the page load speed in low quality network environments, I only placed one picture on this page.
- Team of WIN64AST (I referenced the UI design and many features of this software)
- Team of PCHunter (I referenced some features of this software)
- Team of ProcessHacker (I studied the source code of this software, but I didn't use it in my project)
- Author of DSEFIX (I use it as an alternative solution to load driver)
- If you find bugs, have constructive suggestions or would like to purchase a paid service, please let me know.
- You'd better write E-MAIL in English or German, I only reply to E-MAILs that I am interested in.
- In order to disclose as little personal information as possible (IP address, online time, etc.), I do not use instant messaging. Just write what you want in the E-MAIL.
- In order to reduce the impact of the Internet on real life, I also do not use Facebook, Twitter, etc. Please don't ask me for such information via E-MAIL.
- Binary customization: Modify obvious characteristics of WKE and remove all of my personal information in WKE.
- Implant link: Implant link in WKE on "About" page, all users will see it when main dialog appears.
- Specific feature separation: Copy source code of specific feature to a separate project.
- Driver static library: It contains most of main features of WKE. WBD also uses this static library.
- Driver source code: Entire driver source code of WKE.
- Software customization: Write the user-mode program or kernel-mode driver according to user needs. THIS SERVICE IS ONLY AVAILABLE TO USERS WHO EVER PURCHASED THE ABOVE SERVICES.
Bug fix: Thread entry point cannot be displayed properly in some versions of Windows 7.
Bug fix: LoadImageNotify cannot be enumerated in some versions of Windows 8.
New feature: Output tree view of device stacks to a text file.
New feature: Add a description for GDT items.
Off topic: This version was originally planned to be released on June 1, but due to the Killing of George Floyd, my attention was attracted, which led to the release of this version 10 days later than the original plan. George Floyd’s death is a tragedy, but this is just one of countless tragedies that have been caused since the establishment of the United States. The US government is oppressing the American people, slaughtering the people of the Middle East, committing economic terrorism against countries that refuse to cooperate with it, and bullying European countries. It has caused much more harm to all mankind than Nazi Germany and Communism Soviet Union. Only when this evil regime is completely destroyed can cease such tragedies to occur.
These versions have serious security issues and should not be used anymore.