Skip to content
#

rooty

Star

Here is 1 public repository matching this topic...

KernelPhantom-010 / rooty---Windows-Userland-Function-Hooking-of-NTQUERYSYSTEMINFORMATION

Star 0

Research-focused userland proof-of-concept demonstrating API hooking of NtQuerySystemInformation to analyze and manipulate SYSTEM_PROCESS_INFORMATION structures. The project explores DKOM-style process hiding techniques to better understand Windows internals, detection gaps, and blue-team countermeasures in controlled lab environments only.

cplusplus userland poc function-hooking ntquerysysteminformation-api winapi-32 rooty
  • Updated Feb 22, 2026

Improve this page

Add a description, image, and links to the rooty topic page so that developers can more easily learn about it.

Curate this topic

Add this topic to your repo

To associate your repository with the rooty topic, visit your repo's landing page and select "manage topics."

Learn more