# Hidden | Windows Driver With Usermode Interface Which Can Hide Processes, File-System And Registry Objects

**URL:** <https://onehack.st/t/hidden-windows-driver-with-usermode-interface-which-can-hide-processes-file-system-and-registry-objects/251864>\
**Category:** Tools & Scripts\
**Tags:** hacking, privacy, freebies\
**Created:** [July 18, 2023, 10:44pm UTC](https://onehack.st/t/hidden-windows-driver-with-usermode-interface-which-can-hide-processes-file-system-and-registry-objects/251864 "2023-07-18T22:44:14Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Prometheus](https://onehack.st/user_avatar/onehack.st/prometheus/32/34950_2.png) [@Prometheus](https://onehack.st/u/Prometheus)\
**Post date:** [July 18, 2023, 10:44pm UTC](https://onehack.st/t/hidden-windows-driver-with-usermode-interface-which-can-hide-processes-file-system-and-registry-objects/251864/1 "2023-07-18T22:44:15Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/0/5/05daf785195320d3df6caaf2f94598f183669bc5.jpeg)

# Hidden 🇺🇦

Hidden has been developed like a solution for reverse engineering and researching tasks. This is a windows driver with a usermode interface which is used for hiding specific environment on your windows machine, like installed RCE programs (ex. procmon, wireshark), vm infrastructure (ex. vmware tools) and etc.

## Features

- hide registry keys and values
- hide files and directories
- hide processes (_experimental, might be not stable_)
- protect specific processes
- exclude specific processes from hiding and protection features
- usermode interface (lib and cli) for working with a driver

and so on

## System requirements

Windows Vista and above, x86 and x64

## Recommended build environment

- Visual Studio 2019
- Windows Driver Kit 10

## Building

Following guide explains how to make a release win32 build

1. Open Hidden.sln using Visual Studio
2. Build **Hidden Package** project with configurations Release, Win32
3. Open build results folder **\Release**

## Installing

1. Disable a digital signature enforcement on a test machine (bcdedit /set TESTSIGNING ON) and reboot it
2. Copy files from **\Release\Hidden Package** to a test machine
3. Right mouse click on **Hidden.inf** and choose **Install**
4. Start a driver (sc start hidden)
5. Make sure service is running (sc query hidden)

Important: Keep in mind that the driver bitness have to be the same to an OS bitness

## Hiding

A command line tool **hiddencli** is used for managing a driver. You are able to use it for hiding and unhiding objects, changing a driver state and so on.

To hide a file try the command

```auto
hiddencli /hide file c:\Windows\System32\calc.exe

```

Want to hide a directory? No problems

```auto
hiddencli /hide dir "c:\Program Files\VMWare"

```

Registry key?

```auto
hiddencli /hide regkey "HKCU\Software\VMware, Inc."

```

Maybe a process?

```auto
hiddencli /hide pid 2340

```

By a process image name?

```auto
hiddencli /hide image apply:forall c:\Windows\Explorer.EXE

```

To get a full help just type

```auto
hiddencli /help

```

## GitHub:

[https://github.com/JKornev/hidden](https://github.com/JKornev/hidden)