To hide codes/data in the kernel address space.

Windows 7 or higher, 64-bit.

Using the method of modifying PTEs, switch specific PTEs to the hidden pages before executing hidden codes or reading hidden data, and switch back to the original page after executing or reading.

In order to hide real codes or data in the non-mapped physical pages, and clean original codes or data before calling the hidden functions, we should map the physical pages to correct position. If we have to call windows API in our hidden functions, we should call the transfer functions(not hidden).

• check & change IRQL
• restore & rewrite page table(PTEs)
• call specific APIs

• Visual Studio 2019
• Windows SDK 10
• Windows Driver Kit 10
• QT5.12 for MSVC