Build Windows Kernel Driver to Hide Custom EXE Process (Rootkit-Level EPROCESS Unlink)
Budget: $10 – $100 USD
Job Description:
I'm looking for an experienced Windows kernel-mode developer to create a lightweight driver (SYS file) that can completely hide a specific process from all forms of user-mode and kernel-mode detection.
Requirements:
The driver must:
Be built for Windows 10/11 x64
Load in Test Signing Mode
Unlink the specified process (e.g., myapp.exe) from:
PsActiveProcessHead → ActiveProcessLinks
Optional: Thread list, session list, handle table
Work with processes launched after driver initialization
The hidden process should be invisible to:
Task Manager
NtQuerySystemInformation
EnumProcesses
Process Hacker / Process Explorer
WMI / PowerShell process queries
Secure / lockdown browsers (e.g., LockDownBrowser, ExamBrowser, etc.)
Key Features:
Hardcoded or configurable process name
Source code in C/C++ using WDK
Compatible with Visual Studio 2022 + Windows Driver Kit
Must support runtime load/unload via EXE or batch
Must be safe (no BSOD, no memory leaks)
Deliverables:
ProcessHider.sys driver (compiled + source code)
Loader EXE or batch script to install/start/stop driver
Full source code (.vcxproj or Visual Studio solution)
Optional README for usage on test machine
Bonus: instructions to sign the driver (optional but preferred)
Optional Add-Ons (Nice to Have):
Ability to dynamically hide multiple processes via IOCTL or registry
WMI blocking layer for stealthier hiding
Signature-ready INF install packaging
Notes:
Must not disable security features like PatchGuard unless absolutely required
Only serious developers with kernel driver experience
This is for research, test environments, or compliance-validated setups only
I'm looking for an experienced Windows kernel-mode developer to create a lightweight driver (SYS file) that can completely hide a specific process from all forms of user-mode and kernel-mode detection.
Requirements:
The driver must:
Be built for Windows 10/11 x64
Load in Test Signing Mode
Unlink the specified process (e.g., myapp.exe) from:
PsActiveProcessHead → ActiveProcessLinks
Optional: Thread list, session list, handle table
Work with processes launched after driver initialization
The hidden process should be invisible to:
Task Manager
NtQuerySystemInformation
EnumProcesses
Process Hacker / Process Explorer
WMI / PowerShell process queries
Secure / lockdown browsers (e.g., LockDownBrowser, ExamBrowser, etc.)
Key Features:
Hardcoded or configurable process name
Source code in C/C++ using WDK
Compatible with Visual Studio 2022 + Windows Driver Kit
Must support runtime load/unload via EXE or batch
Must be safe (no BSOD, no memory leaks)
Deliverables:
ProcessHider.sys driver (compiled + source code)
Loader EXE or batch script to install/start/stop driver
Full source code (.vcxproj or Visual Studio solution)
Optional README for usage on test machine
Bonus: instructions to sign the driver (optional but preferred)
Optional Add-Ons (Nice to Have):
Ability to dynamically hide multiple processes via IOCTL or registry
WMI blocking layer for stealthier hiding
Signature-ready INF install packaging
Notes:
Must not disable security features like PatchGuard unless absolutely required
Only serious developers with kernel driver experience
This is for research, test environments, or compliance-validated setups only