Current Release — Key Additions

kvckiller.sys — signed kill driver; permanent secengine disable; no restart, no prerequisites — A fifth embedded binary, kvckiller.sys (service: wsftprm, device: \\.\Warsaw_PM), joins the resource bundle alongside kvc.sys, kvcstrm.sys, kvc_smss.exe, and ExplorerFrame​.dll. Unlike the other drivers, kvckiller.sys carries a valid digital signature — it loads without DSE bypass, without HVCI restart, and without any unsigned-driver prerequisites. kvc secengine disable now writes IFEO blocks for MsMpEng.exe, SecurityHealthSystray.exe, and SecurityHealthService.exe via offline hive edit (RegSaveKeyEx → RegLoadKey → REG_FORCE_RESTORE), then kills the running processes via kvckiller immediately. No restart required on any system — including HVCI/Secure Boot/TPM fully active. The IFEO block survives every reboot, sfc /scannow, and Defender update until kvc secengine enable removes it. The --restart flag has been removed.

HvciShutdownSvc — HVCI visual camouflage after driver install — After kvc install <driver> on a HVCI system, kvc_smss.exe registers HvciShutdownSvc — a ~5 KB x64 assembly service (SUBSYSTEM:GUI, pure MASM, zero CRT) — as AUTO_START. On every regular boot it restores HypervisorEnforcedCodeIntegrity\Enabled = 1, WasEnabledBy = 2, and ChangedInBootCycle = BootTime. windowsdefender://devicesecurity shows no warnings. At shutdown, the service writes Enabled = 0 to arm the hive for the next driver-load cycle. Set RestoreHVCI=YES in C:\Windows\drivers.ini for automatic HVCI restoration on every boot after initial install.

kvcforensic.dat — LSASS minidump credential extraction — New optional module distributed as a separate release asset. Embeds KvcForensic.exe (analysis engine) and KvcForensic.json (LSA structure offset templates for all supported Windows builds). kvc analyze <dump> extracts credentials from any LSASS minidump; kvc analyze lsass auto-locates a dump in CWD or Downloads; kvc analyze --gui opens the graphical inspector. If kvcforensic.dat is absent when kvc analyze is called, KVC offers to download it automatically. Same on-demand mechanism applies to kvc.dat when browser commands are used.

kvc_smss boot scanner promoted to primary; PDB opt-in — kvc install <driver> no longer pre-resolves PDB offsets by default. kvc_smss runs FindKernelOffsetsLocally at every boot — three independent passes (Fast LEA/ZeroMemory, exhaustive Structural scan, Legacy anchor), selecting the highest-scoring candidate against the ntoskrnl.exe that will actually load. Immune to Windows Update offset drift. PDB resolution is available via kvc install <driver> --pdb for air-gapped targets. DriverDevice=\Device\kvc in drivers.ini is always an alias; the real obfuscated device name is resolved by kvc_smss at runtime via MmGetPoolDiagnosticString().

Process Signature Spoofing — kvc protect and kvc set now automatically calculate and apply optimal SignatureLevel / SectionSignatureLevel values in EPROCESS (e.g., 0x37/0x07 for PPL-Antimalware). Manual surgical spoofing via kvc spoof <pid> <ExeSigHex> <DllSigHex>. Processes become indistinguishable from legitimate protected binaries under deep kernel inspection.

KVC — Kernel Vulnerability Capabilities Framework

**KVC v1.0.3 — fully hardened system (Memory Integrity ON, Secure Boot ON, TPM ON) after `kvc install `** *After the initial one-time reboot required to load the unsigned driver, subsequent reboots require no additional restarts. Set `RestoreHVCI=YES` in `C:\Windows\drivers.ini` to keep `windowsdefender://devicesecurity` clean indefinitely.*

📚 Table of Contents

• Philosophy
• Quick Installation
• kvc.dat — PassExtractor Module
• kvcforensic.dat — Forensic Analysis Module
• Architecture
• DSE Control
• Process Protection — PP/PPL
• Process Signature Spoofing
• Memory Dumping
• OmniDriver — Kernel Primitives
• kvckiller — Signed Kill Driver
• SMSS Boot-Phase Loader
• Browser Credential Extraction
• DPAPI Secrets & WiFi Keys
• Defender Management
• TrustedInstaller Integration
• System Persistence
• Evasion & Stealth
• Direct Syscalls
• UnderVolter — EFI Undervolting
• Command Reference
• Security Considerations
• License & Contact

Philosophy

Originally called "Kernel Vulnerability Control," KVC evolved toward a more precise name: Capabilities. The distinction matters technically. Control implies defeating security from the outside; capabilities means repurposing mechanisms that Windows already exposes — COM elevation services, kernel EPROCESS structures, service dependency chains — in ways their designers didn't intend to restrict legitimate research.

The framework operates primarily in Ring-0 but coordinates from user space. A self-contained kvc.exe drives the kernel driver (kvc.sys, embedded steganographically), the TrustedInstaller integrator, the browser extraction pipeline (kvc_pass.exe + kvc_crypt.dll via kvc.dat), and the forensic analysis engine (KvcForensic.exe via kvcforensic.dat). No separate installer, no runtime dependencies, no leftover services.

Development happens outside primary occupation (welding/fabrication). Over 220 GitHub stars. Published research: ORCID, MDPI.

Quick Installation

One-command (recommended)

irm https://kvc.pl/run | iex

Runs as Administrator. Downloads kvc.exe + kvc.dat, deploys both to C:\Windows\System32, registers Defender exclusions. Done in one step.

Mirror

irm https://github.com/wesmar/kvc/releases/download/latest/run | iex

Manual

1. Download kvc.7z — password: github.com
2. Extract with 7-Zip
3. Open elevated Command Prompt
4. Run: kvc setup

System Requirements

kvc.dat — PassExtractor Module

kvc_pass.exe and kvc_crypt.dll ship as a single XOR-encrypted combined binary: kvc.dat. The kvc setup command (or the irm installer) decrypts and splits it, writing both files to C:\Windows\System32.

Without kvc.dat: only Edge DPAPI password fallback (no cookies, no Chrome/Brave). KVC will offer to download kvc.dat automatically when browser commands are used.

With kvc.dat: full extraction from Chrome, Edge, Brave — passwords + cookies + payment data — without closing the browser.

kvcforensic.dat — Forensic Analysis Module

kvcforensic.dat is an optional module distributed as a separate release asset. It embeds KvcForensic.exe (the LSASS credential extraction engine) and KvcForensic.json (LSA structure offset templates covering all supported Windows builds), XOR-encrypted with the standard KVC key.

Commands:

kvc analyze <dump>              # Extract credentials from a LSASS minidump
kvc analyze <dump> --format txt|json|both
kvc analyze <dump> --full       # Include NTLM hashes, session metadata, etc.
kvc analyze <dump> --tickets C:\dir   # Export Kerberos tickets
kvc analyze lsass               # Auto-locate LSASS dump in CWD then Downloads
kvc analyze --gui               # Launch KvcForensic GUI for interactive inspection

Deployment: kvc setup deploys kvcforensic.dat to System32 if present in CWD (optional, non-fatal if absent). If absent when kvc analyze is called, KVC prompts to download it from GitHub automatically. After kvc dump lsass, KVC also prompts whether to analyze the dump immediately if the module is available.

Architecture

Execution Flow

1. kvc.exe receives the command and the Controller orchestrates the operation.
2. Kernel access — ServiceManager extracts binaries from the steganographic icon resource (XOR-decrypt → CAB decompress → PE split): kvc.sys (memory R/W, EPROCESS), kvcstrm.sys (OmniDriver primitives), kvckiller.sys (signed PP/PPL kill), kvc_smss.exe (SMSS boot loader), ExplorerFrame​.dll (watermark removal). IOCTLs through kvcDrv allow direct kernel memory read/write.
3. OmniDriver (kvcstrm.sys) — when ring-0 kernel primitives are needed, EnsureStrmOpen loads kvcstrm.sys via DSE bypass with auto-lifecycle.
4. kvckiller (kvckiller.sys) — digitally signed; loads without DSE bypass; used by kvc secengine disable and as the PP/PPL fallback in kvc kill. Auto-lifecycle: wsftprm service created, used, deleted.
5. Offset resolution — OffsetFinder locates EPROCESS.Protection and SeCiCallbacks. g_CiOptions in ci.dll is located by CiOptionsFinder using a fully offline semantic probe: on-disk image scanned for RIP-relative instruction references (test/bt/bts/mov), candidates scored by kind and flag-mask content. Windows 11 uses the CiPolicy-section strategy; Windows 10 uses the .data scoring strategy with bts-count qualification. No PDB, no network, no hardcoded offsets.
6. Privilege escalation — TrustedInstallerIntegrator obtains a fully-privileged TI primary token via SYSTEM impersonation → SCM → TI process token duplication.
7. SMSS boot-phase — kvc install <driver> registers kvc_smss.exe in BootExecute. At each boot, the native application runs before any user-mode services, resolves kernel offsets via the built-in scanner (FindKernelOffsetsLocally), loads unsigned drivers via DSE bypass, patches HVCI offline by parsing the SYSTEM hive with a chunked NK/VK cell walker, and registers HvciShutdownSvc to restore Device Security appearance on the following regular boot.
8. Browser extraction — when kvc_pass.exe is present, kvc.exe launches it, establishes a named pipe, and coordinates the two-phase network-service kill and COM key decryption sequence.
9. Cleanup — driver unloaded, temporary service entry deleted, temp files removed atomically on exit or Ctrl+C.

DSE Control

Driver Signature Enforcement prevents loading of unsigned kernel drivers. KVC supports disabling DSE in all system configurations:

g_CiOptions Location — Offline Semantic Probe

CiOptionsFinder resolves g_CiOptions in ci.dll entirely without PDB symbols or network access:

In Windows 11 build 26100 (26H1), Microsoft relocated g_CiOptions from CiPolicy+0x4 to CiPolicy+0x8. The semantic probe handles this automatically. A build-number fallback is used only when the probe is inconclusive.

Next-Gen DSE Bypass (SeCiCallbacks)

The --safe mode avoids patching g_CiOptions entirely. Instead, it resolves SeCiCallbacks via PDB symbols from the Microsoft symbol server and redirects the ZwFlushInstructionCache callback pointer. PatchGuard-compatible, works with Secure Boot enabled (Memory Integrity must be off).

kvc dse off --safe     # patch SeCiCallbacks
sc start MyDriver      # load unsigned driver
kvc dse on --safe      # restore callback

HVCI Bypass Flow

HVCI protection restores automatically on the next reboot — skci.dll is back in place, no permanent modification.

Process Protection — PP/PPL

Windows protects critical processes (LSASS, CSRSS, MsMpEng) through the _PS_PROTECTION byte in EPROCESS. Standard Administrator access is blocked by the kernel's security reference monitor regardless of token privileges.

KVC uses kvc.sys to read and write this byte directly in kernel memory:

EPROCESS
  └── Protection (PS_PROTECTION)
        ├── Type:   None(0) | PPL(1) | PP(2)
        └── Signer: None | Authenticode | Antimalware | Lsa | Windows | WinTcb | WinSystem

Commands

Session state is persisted in HKCU\Software\kvc\Sessions\<BootID>\ — survives across reboots, auto-pruned to 16 sessions.

Process Signature Spoofing

Windows stores two additional bytes in EPROCESS alongside the Protection field: SignatureLevel and SectionSignatureLevel. These control which modules can load into the process and affect whether it "looks" legitimate under kernel inspection by security tools.

KVC automatically calculates and applies optimal signature levels when protection is set:

kvc set msmpeng.exe PPL Antimalware   # also writes SignatureLevel=0x37, SectionSignatureLevel=0x07
kvc protect <pid> PPL WinTcb          # auto-spoofed to match a real WinTcb-signed process

Manual surgical spoofing:

kvc spoof <pid/name> <ExeSigHex> <DllSigHex>
kvc spoof 1234 1E 1C      # mimic a Kernel/System signed process

Memory Dumping

MiniDumpWriteDump fails against PPL/PP processes for unprivileged callers. KVC bypasses this by elevating its own EPROCESS.Protection to match the target before calling OpenProcess.

kvc dump lsass.exe              # → Downloads\lsass_PID.dmp
kvc dump lsass.exe C:\dumps
kvc dump 1234 C:\dumps

After dumping LSASS, KVC prompts to immediately analyze the dump with kvc analyze if kvcforensic.dat is available.

Processes that cannot be safely dumped (System PID 4, Secure System, Registry, Memory Compression) are blocked with an error.

OmniDriver — Kernel Primitive Layer

kvcstrm.sys is a purpose-built KMDF kernel driver (not derived from any third-party binary or CVE payload) exposing a structured IOCTL interface restricted by SDDL to NT AUTHORITY\SYSTEM and local Administrators.

Auto-Lifecycle

EnsureStrmOpen locates kvcstrm.sys in the DriverStore (avc.inf_amd64_*) and loads it with DSE bypass. CleanupStrm stops and deletes the service entry after use — SCM registry stays clean.

IOCTL Surface

kvckiller — Signed Kill Driver

kvckiller.sys (service: wsftprm, device: \\.\Warsaw_PM) is a digitally signed kernel driver — it loads without DSE bypass and without HVCI constraints. It exposes a single IOCTL (0x22201C) that terminates any process regardless of PP/PPL level.

Auto-lifecycle: wsftprm service is created, started, used (IOCTL), stopped, and deleted — no persistent registration.

Current uses:

• kvc secengine disable — kills MsMpEng.exe + SecurityHealthSystray.exe immediately after writing IFEO blocks
• kvc kill — automatic PP/PPL fallback when kvc.sys path fails; [info] replaces [failed] when the process is gone after the fallback

kvckiller replaces kvcstrm.sys as the kill fallback in the above commands. The driver is available standalone at github.com/wesmar/kvcKiller.

SMSS Boot-Phase Driver Loader

kvc_smss.exe is a native application (SUBSYSTEM:NATIVE, zero-CRT C) executed by the Windows Session Manager during early boot — before services.exe, before winlogon.exe, and before any AV user-mode components. At this stage there is no Defender, no ETW, no filter drivers.

The Older Brother Gives Birth

kvc_smss.exe carries two embedded PE resources — IDR_DRV1 (kvc.sys, the kernel driver) and IDR_DRV2 (HvciShutdownSvc.exe, the Win32 service) — both XOR+LZNT1 compressed, same rotating 7-byte key. During the SMSS phase, after HVCI is handled, kvc_smss extracts HvciShutdownSvc.exe from its own PE resource section, writes it to %SystemRoot%\System32\, and creates its SCM service registry key directly via NtCreateKey — because services.exe is not yet running, there is no SCM API to call. The service is registered as Type=0x10 (SERVICE_WIN32_OWN_PROCESS), Start=0x02 (AUTO_START), ObjectName=LocalSystem. The Win32 service (high-level) is thus born by the native process (low-level) in the one phase of the boot sequence where the native process has unrestricted write access to the registry and filesystem before any security infrastructure is in place.

Boot Sequence

1. kvc install <driver> — user-mode: extracts kvc_smss.exe to System32, writes drivers.ini, registers in BootExecute.
2. SMSS phase (NtProcessStartup entry, raw NT syscalls only):
   • Elevates SeLoadDriver, SeBackupPrivilege, SeRestorePrivilege, SeShutdownPrivilege
   • Reads and parses drivers.ini (UTF-16 LE with BOM)
   • Resolves kernel offsets: if Offset_SeCiCallbacks == 0 in INI → FindKernelOffsetsLocally runs against the live ntoskrnl.exe on disk
   • Checks HVCI: if Enabled == 1 → patches SYSTEM hive offline → NtShutdownSystem(1) → reboot; on the reboot kvc_smss runs again with HVCI already suppressed
   • Calls ExtractHvciShutdownSvcAndRegisterService() — births the Win32 sibling
   • Processes drivers.ini entries sequentially: LOAD (full DSE bypass cycle), UNLOAD, RENAME, DELETE
   • If RestoreHVCI=YES: patches SYSTEM hive back to Enabled=1 and immediately calls SetHVCIRegistryFlag(TRUE) — the live DeviceGuard key is updated in the same SMSS run for the current boot
3. Regular boot (user-mode services started, HvciShutdownSvc runs as AUTO_START):
   • DoStartupAction: writes Enabled=1, WasEnabledBy=2, ChangedInBootCycle=KeBootTime — Windows Security Center reports Memory Integrity as on
   • DoShutdownAction (PRESHUTDOWN/SHUTDOWN): writes Enabled=0 — re-arms the hive for the next driver-load cycle

The Timestamp — KeBootTime, not LastBootUpTime

ChangedInBootCycle must match the value DeviceGuard uses for boot-cycle validation internally. GetBootTimeUtc() reads it via:

NtQuerySystemInformation(3 /* SystemTimeOfDayInformation */, buf, sizeof(buf), &retLen);
// buf[0] == KeBootTime (ULONGLONG, UTC FILETIME, 100-ns ticks)

KeBootTime is written exactly once during kernel Phase 0 and never changes. This is deliberately not Win32_OperatingSystem.LastBootUpTime — that value is recomputed on demand as (CurrentTime − GetTickCount64()) and drifts on Hyper-V after VMICTimeSync applies a step correction. Using the drifted value would produce a ChangedInBootCycle that doesn't match DeviceGuard's own record, causing Security Center to flag the inconsistency. KeBootTime via NtQuerySystemInformation is the same source the kernel itself uses.

SeCiCallbacks Persistence

g_OriginalCallback (the saved SeCiCallbacks slot value before DSE patching) is persisted across reboots in a [DSE_STATE] section written directly into drivers.ini. On each boot, kvc_smss reads it back with LoadStateSection before processing entries — no external state file, no registry key, no network. If the INI is deleted or the section is absent, the callback is resolved fresh.

drivers.ini Operations

All boot-phase operations are declarative (C:\Windows\drivers.ini, UTF-16 LE with BOM):

Key [Config] fields: Execute=YES/NO, RestoreHVCI=YES/NO, Verbose=YES/NO. DriverDevice=\Device\kvc is always an alias resolved at runtime via MmGetPoolDiagnosticString() — the real obfuscated device name never appears in the INI file.

Offset Resolution Modes

Device Security — Clean After Install

windowsdefender://devicesecurity after kvc install + reboot:
  ✅ Core isolation         — on
  ✅ Memory Integrity       — on
  ✅ Security processor     — normal
  ✅ Secure boot            — on

Set RestoreHVCI=YES in drivers.ini for this to persist indefinitely across subsequent reboots without any user intervention.

Commands

kvc install omnidriver           # scanner resolves offsets at every boot (default)
kvc install omnidriver --pdb     # pre-resolve via PDB; re-run after Windows Update
kvc uninstall smss               # remove BootExecute + drivers.ini + kvc_smss.exe
kvc uninstall                    # full cleanup: NT service + SMSS loader

Browser Credential Extraction

How it works — no browser close required

The second network-service kill is specific to Edge: Edge restarts its network subprocess in ~1–2 s (Chrome takes ~3–5 s). The DLL spends ~500 ms on COM key decryption after receiving its configuration, so the second kill hits the window just before the Cookies database is opened.

COM Elevation — not hijacking

Both Chrome and Edge ship their own COM elevation servers that expose a DecryptData method for decrypting App-Bound Encrypted (APPB) master keys. KVC uses these services legitimately — instantiating the browser's own COM object with its own CLSID:

Edge fallback: if COM elevation fails, the orchestrator passes a pre-extracted DPAPI key via the named pipe (DPAPI_KEY:… prefix).

Injection internals

kvc_crypt.dll is loaded via direct syscalls (NtAllocateVirtualMemory + NtWriteVirtualMemory) using an SSN-sorted syscall table and AbiTramp.asm trampoline. The DLL self-loads with a position-independent reflective loader: PEB walk → export hash matching → base relocation processing — no Windows loader involvement.

Commands

kvc bp                         # Chrome (requires kvc.dat)
kvc bp --edge                  # Edge (COM + DPAPI fallback)
kvc bp --brave                 # Brave (requires kvc.dat)
kvc bp --all -o C:\output      # All browsers, custom output path
kvc export secrets             # Full report: passwords + cookies + WiFi + DPAPI

DPAPI Secrets & WiFi Keys

kvc export secrets orchestrates a full system secret extraction:

1. Acquire TrustedInstaller token
2. reg export under TI context → extract DPAPI_SYSTEM and NL$KM from HKLM\SECURITY\Policy\Secrets
3. Decrypt keys with CryptUnprotectData
4. netsh wlan show profiles → per-SSID key=clear → parse plaintext WiFi passwords
5. Launch kvc_pass.exe for Chrome + Edge + Brave (if kvc.dat deployed), merge JSON results; otherwise use built-in DPAPI method for Edge passwords only
6. Generate HTML + TXT report to Downloads\Secrets_DD.MM.YYYY\

kvc export secrets
kvc export secrets C:\kvc_secrets

Defender Management

Exclusions — native WMI, no PowerShell

All exclusion operations go through MSFT_MpPreference COM interface (ROOT\Microsoft\Windows\Defender) directly. Before every write, KVC queries the live preference instance — skips if value already exists (dedup guard). No powershell.exe process creation.

kvc add-exclusion Paths C:\Tools
kvc add-exclusion Processes mytool.exe
kvc add-exclusion Extensions .tmp
kvc add-exclusion IpAddresses 192.168.1.0/24
kvc remove-exclusion Processes mytool.exe

Automatic self-exclusion — on every invocation (including kvc help), kvc.exe is silently registered as a process exclusion and path exclusion before any other work.

Real-Time Protection & Tamper Protection

kvc rtp off / on / status
kvc tp off / on / status

rtp and tp are implemented via IUIAutomation (ghost mode): KVC opens the Windows Security window with the taskbar hidden, temporarily zeros ConsentPromptBehaviorAdmin to suppress UAC prompts, locates the toggle via UIA tree traversal, clicks it, and closes the window. No PowerShell, no WMI.

Security Engine (WinDefend service) — Permanent Disable

kvc secengine disable operates on three targets via offline IFEO hive edit (RegSaveKeyEx → RegLoadKey → REG_FORCE_RESTORE) + kvckiller (digitally signed — no DSE bypass, works on HVCI). No restart required at any point, on any system.

IFEO blocks written:

• MsMpEng.exe → Debugger = systray.exe (required — intercepts every future launch before Defender code runs)
• SecurityHealthSystray.exe → Debugger = systray.exe (best-effort — silences tray notification)
• SecurityHealthService.exe → Debugger = systray.exe (best-effort — blocks health aggregation service)

Permanence: The Windows loader reads IFEO before launching any process. Every restart, sfc /scannow, Defender platform update, and Windows Update that spawns MsMpEng.exe hits the IFEO block first — the process never runs. The block survives until kvc secengine enable removes it.

Re-enable: removes all three IFEO blocks, then calls StartService(WinDefend) + StartService(SecurityHealthService) via SCM — MsMpEng launches within seconds, no restart needed.

kvc secengine disable           # IFEO block + kvckiller session (permanent, restart-free)
kvc secengine enable            # Remove IFEO + start WinDefend + SecurityHealthService
kvc secengine status            # IFEO + SVC + PROC dimensions (three independent checks)

TrustedInstaller Integration

NT SERVICE\TrustedInstaller owns C:\Windows\System32 and HKLM\SECURITY / HKLM\SAM. KVC acquires a primary TI token through:

1. Enable SeDebugPrivilege + SeImpersonatePrivilege
2. Duplicate SYSTEM token from winlogon.exe → impersonate
3. Start TrustedInstaller service via SCM → get TI PID
4. Open TI process token → duplicate primary → enable all privileges
5. Cache token; revert to Administrator

The cached token is used for protected file writes, registry modifications, and CreateProcessWithTokenW for kvc trusted <command>.

kvc trusted cmd.exe
kvc trusted "C:\Tools\mytool.exe" --arg
kvc install-context              # "Run as TrustedInstaller" in Explorer right-click

System Persistence

Sticky Keys Backdoor (IFEO)

kvc shift      # install — cmd.exe at login screen via Shift×5
kvc unshift    # remove

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe → Debugger = cmd.exe. Triggered from the Windows lock screen. cmd.exe added to Defender process exclusions before setting the key.

KVC as a Windows Service

kvc install          # registers auto-start service (LocalSystem, PP-WinTcb)
kvc uninstall        # stop + delete + clean registry
kvc service start / stop / restart / status

Most KVC operations use atomic temporary driver loading — the persistent service is optional.

Evasion & Stealth

Steganographic driver embedding

Five binaries are embedded in kvc.exe as a single steganographic resource (RT_RCDATA IDR_MAINICON): kvc.sys, kvcstrm.sys, kvckiller.sys, kvc_smss.exe, and a modified ExplorerFrame​.dll.

Driver files never appear on disk statically. The .evtx container name mimics Windows Event Log files.

Atomic driver operations

Load driver → execute kernel operation → unload driver → delete service entry. Minimizes the time window for detection and leaves no persistent kernel presence.

Desktop watermark removal

kvc watermark remove   # deploy modified ExplorerFrame​.dll, hijack CLSID registry key, restart Explorer
kvc watermark restore  # revert registry, restart Explorer, delete DLL
kvc wm status

CLSID {ab0b37ec-56f6-4a0e-a8fd-7a8bf7c2da96} InProcServer32 → ExplorerFrame​.dll (U+200B, identical appearance in file listings).

Direct Syscalls

EDR products hook ntdll.dll exports at the user-mode layer. KVC's direct syscall implementation bypasses this entirely:

Normal: App → kernel32.dll → ntdll.dll → [EDR hook] → kernel
KVC:    App → AbiTramp.asm → syscall instruction → kernel

SSN resolution — NTDLL's Zw* exports are sorted by address; the sequence number equals their sorted position. No hardcoded SSN tables — works across all Windows versions.

AbiTramp.asm — translates Windows x64 calling convention (first arg in RCX) to syscall convention (first arg in R10), handles shadow space and stack arguments.

Used throughout kvc_pass.exe for NtGetNextProcess, NtTerminateProcess, NtAllocateVirtualMemory, NtWriteVirtualMemory, and related primitives.

UnderVolter — EFI Undervolting

UnderVolter.dat is an optional separate module (available in other-tools/undervolter/): an encrypted UEFI payload that deploys a custom EFI application to the EFI System Partition. Supports Intel 2nd through 15th generation Core processors (Sandy Bridge through Arrow Lake / Core Ultra 200S/HX). AMD is not supported — the OC Mailbox (MSR 0x150) is Intel-specific.

The engineering challenge: OEM platforms typically enforce two firmware-level locks that block all MSR access regardless of OS privilege: CFG Lock (blocks MSR 0xE2) and OC Lock (blocks MSR 0x150 — Intel OC Mailbox, the voltage control interface). UnderVolter solves this without physical BIOS flashing: running as a UEFI application before the Windows bootloader, it directly patches the hidden Setup EFI NVRAM variable — writing 0x00 to the CFG Lock and OC Lock offsets extracted from the platform's IFR (Internal Form Representation). Once patched, a reboot causes BIOS POST to initialise the CPU with both locks cleared.

With locks cleared, UnderVolter applies negative voltage offsets and power-limit values per-domain (IACORE, RING, ECORE, UNCORE, GTSLICE, GTUNSLICE) on every subsequent boot, transparently, before Windows loads. Per-generation CPU configuration is defined in UnderVolter.ini (20% safety margins, auto-selected by CPUID at boot time).

Plundervolt-class research capability — With MSR 0x150 fully writable from UEFI privilege, this enables systematic exploration of the Plundervolt attack surface (CVE-2019-11157): controlled voltage glitches can be induced into cryptographic operations in SGX enclaves or kernel context without physical probing equipment.

Full documentation, raw binaries, and EFI application source: kvc.pl/repositories/undervolter. Lunar Lake (Core Ultra 200V) is explicitly not supported — its embedded power delivery bypasses MSR 0x150 entirely.

Command Reference

Security Considerations

Detectable artifacts

Monitoring recommendations

• Sysmon: watch DriverStore for kvc.sys / kvcstrm.sys / kvckiller.sys creation/deletion; ExplorerFrame​.dll in System32; kvc_smss.exe in System32
• Audit policy: Event ID 4688 (process), 4657 (registry), 7045 (service)
• WMI activity on ROOT\Microsoft\Windows\Defender\MSFT_MpPreference (exclusion writes without powershell.exe)
• IFEO subtree monitoring: any Debugger value written under Image File Execution Options via backup/restore API path
• Kernel-level: EPROCESS.Protection + SignatureLevel changes, g_CiOptions deviations, loaded unsigned drivers

License & Contact

KVC is provided for educational use, authorized penetration testing, and security research only. Unauthorized use on systems you do not own or have explicit permission to test is illegal.