--- title: WinDefCtl url: 'https://kvc.pl/repositories/windefctl' markdown: 'https://kvc.pl/repositories/windefctl.md' date: '2026-08-29' description: 'WinDefCtl: Windows Defender control utility β€” full engine kill via IFEO+kvckiller.sys and RTP/TP automation. v2.0 with Direct2D overlay.' --- > WinDefCtl: Windows Defender control utility β€” full engine kill via IFEO+kvckiller.sys and RTP/TP automation. [ Download WinDefCtl.7z](https://kvc.pl/repositories/windefctl/WinDefCtl.7z) [ Download Source Code](https://kvc.pl/repositories/windefctl/src.zip) [ Download generator.zip](https://kvc.pl/repositories/windefctl/generator.zip) [ Source on GitHub](https://github.com/wesmar/WinDefCtl) πŸ” ARCHIVE PASSWORD: `github.com` # WinDefCtl β€” Windows Defender Automation & Control Utility **RTP/TP slider control + full engine kill via IFEO + kvckiller.sys** [![License](https://img.shields.io/badge/license-MIT-blue.svg)](https://kvc.pl/repositories/windefctl/LICENSE) ![Platform](https://img.shields.io/badge/platform-Windows%2011-blue) ![Build](https://img.shields.io/badge/build-passing-brightgreen) --- ## πŸ“₯ Download ### kvc.pl (recommended) **`WinDefCtl.7z`** β€” archive contains four files (current + legacy preserved for posterity): | File | Size | Description | |---|---|---| | `WinDefCtl_v2.exe` | ~380 KB | **v2.0** β€” engine kill + RTP/TP control (current, C++ binary) | | `WinDefCtl-v2.ps1` | ~65 KB | **v2.0** β€” single-file PowerShell edition, same command palette (addon) | | `WinDefCtl.exe` | ~48 KB | **v1.x** β€” RTP/TP automation only (legacy C++ binary) | | `WinDefCtl.ps1` | ~23 KB | **v1.x** β€” PowerShell script version (legacy) | **`generator.zip`** β€” sources for rebuilding the PowerShell edition (`template.ps1`, `build-ps.ps1`, `kvckiller.sys`). Run `build-ps.ps1` β†’ emits a fresh `out\WinDefCtl-v2.ps1` with the driver re-embedded as base64 LZX CAB. > Run as **Administrator**. ### GitHub Also available at [github.com/wesmar/WinDefCtl](https://github.com/wesmar/WinDefCtl/releases) β€” `WinDefCtl.exe` (v2.0 only) and password-protected `WinDefCtl.7z` (password: **`github.com`**, use if SmartScreen blocks the exe). --- ## πŸš€ v2.0 β€” Quick Start ```cmd WinDefCtl kill # Kill Defender engine (IFEO block + kernel kill, no restart) WinDefCtl restore # Restore Defender (remove IFEO + start services) WinDefCtl rtp off # Disable Real-Time Protection WinDefCtl rtp on # Enable Real-Time Protection WinDefCtl rtp status # Check RTP state WinDefCtl tp off # Disable Tamper Protection WinDefCtl tp on # Enable Tamper Protection WinDefCtl tp status # Check Tamper Protection state ``` --- ## πŸ“‹ Changelog ### v2.0 β€” 05.2026 β€” Full Engine Kill + Direct2D Overlay **New: `kill` / `restore` β€” engine kill without reboot** - **IFEO offline hive bypass** β€” `RegSaveKeyEx` β†’ `RegLoadKey(TempIFEO)` β†’ write `Debugger=systray.exe` β†’ `RegUnLoadKey` β†’ `RegRestoreKey(REG_FORCE_RESTORE)` β€” bypasses Tamper Protection at kernel level without touching the live hive - **Ring-0 kill via `kvckiller.sys`** β€” digitally signed driver (service: `wsftprm`), IOCTL `0x22201C` on `\\.\Warsaw_PM`, terminates `MsMpEng.exe` + `SecurityHealthSystray.exe`, `SecurityHealthService` stopped via SCM - **Driver embedded in icon** β€” LZX CAB appended to `.ico` resource, extracted at runtime via FDI in-memory decompression; no file dropped until `kill` is actually called - **Smart service reuse** β€” detects existing `wsftprm` from KVC DriverStore installation; reuses without overwriting **Improved: RTP/TP control** - **Direct2D full-screen overlay** replaces console-maximization trick β€” `WS_EX_LAYERED | WS_EX_TOPMOST` window on dedicated background thread, Consolas Bold 80pt pulsing green text, animated `PLEASE WAIT...` dots, CRT scanline effect - Overlay shown during `rtp`/`tp` UI automation; `kill`/`restore` are silent (no overlay) **Build** - `/MT` static CRT β€” no `vcruntime140.dll` / `MSVCP*.dll` dependency - Single `WinDefCtl_v2.exe` ~380 KB, no installer, no PDB in release build --- ### v1.x β€” RTP/TP UI Automation Only Original version β€” no engine kill, no driver. Controls RTP and Tamper Protection exclusively via Windows Security UI Automation API. **Key mechanisms:** - **Stealth window management ("Ghost Mode")** β€” opens Windows Security completely invisibly: alpha=0, DWM cloak, off-screen positioning (-4000,-4000), `ShowWindow` without activate - **Cold boot pre-warming** β€” on first run after login, Windows Security UI components are not yet loaded; v1.x detects this via volatile registry key (`HKCU\Software\WinDefCtl\WinDefCtl_Warmed`) and pre-warms the window (~5-7 sec penalty, subsequent runs skip) - **UAC suppression** β€” temporarily sets `ConsentPromptBehaviorAdmin=0` + `PromptOnSecureDesktop=0`, restores on completion; crash-safe (detects incomplete restore on next startup) - **Structural density detection** β€” counts UI elements before/after toggle to confirm state change (no fragile element-name matching) **Available as:** compiled `WinDefCtl.exe` (~48 KB) and `WinDefCtl.ps1` PowerShell script (identical logic, reviewable source). **Commands (v1.x):** ```cmd WinDefCtl rtp status / on / off WinDefCtl tp status / on / off ``` --- ## βš™οΈ How It Works β€” v2.0 Engine Kill ### IFEO Bypass (Tamper Protection circumvention) Standard registry writes to `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options` are blocked by Tamper Protection. v2.0 works around this at kernel level: 1. `RegSaveKeyEx` β€” saves live IFEO hive to temp file (requires `SE_BACKUP_NAME`) 2. `RegLoadKey` β€” loads temp file as `HKLM\TempIFEO` (requires `SE_RESTORE_NAME`) 3. Write `Debugger=systray.exe` under `TempIFEO\MsMpEng.exe` 4. `RegUnLoadKey` β€” unloads temp hive 5. `RegRestoreKey(REG_FORCE_RESTORE)` β€” force-replaces live IFEO hive β€” Tamper Protection cannot intercept this path `restore` reverses the process: same bypass, removes the `Debugger` value. ### kvckiller.sys (Ring-0 Kill) After IFEO block is set, `MsMpEng.exe` cannot restart β€” but the currently running instance must still be terminated. WinDefCtl loads `kvckiller.sys` (the same signed driver used by KVC) via service `wsftprm`: - Device: `\\.\Warsaw_PM` - IOCTL: `0x22201C` β€” 1036-byte buffer, PID at offset 0 - Terminates: `MsMpEng.exe`, `SecurityHealthSystray.exe` - SCM: stops `SecurityHealthService` If `wsftprm` already exists (KVC installed), WinDefCtl detects the valid DriverStore path and reuses the service β€” no overwrite, no conflict. --- ## πŸ“œ PowerShell Edition v2.0 (Addon) `WinDefCtl-v2.ps1` β€” same command palette as the C++ binary in a single ~65 KB self-contained PowerShell script. No compiler, no Visual Studio, no NuGet. Drop the file anywhere and run from elevated PowerShell. ```powershell .\WinDefCtl-v2.ps1 # show help (also: /?, -?, -h, --help, "help") .\WinDefCtl-v2.ps1 status # read Defender state (read-only) .\WinDefCtl-v2.ps1 kill # IFEO block + BYOVD kernel kill .\WinDefCtl-v2.ps1 restore # remove IFEO + start WinDefend .\WinDefCtl-v2.ps1 rtp off # Real-Time Protection toggle off .\WinDefCtl-v2.ps1 tp on # Tamper Protection toggle on ``` ### How it works | Layer | Implementation | |---|---| | Driver embedding | `kvckiller.sys` packed with `makecab.exe` (LZX) β†’ base64-chunked β†’ inline `$DriverCabB64` | | Driver deployment | `expand.exe` decompresses CAB directly to `%SystemRoot%\System32\drivers\kvckiller.sys` | | SCM lifecycle | `sc.exe create wsftprm type= kernel start= demand` β†’ `sc.exe start` β†’ `sc.exe stop`/`delete` | | Kernel kill | P/Invoke `CreateFileW(\\.\Warsaw_PM)` + `DeviceIoControl(0x22201C, )` | | IFEO bypass | `reg.exe save` β†’ `reg.exe load HKLM\TempIFEO` β†’ write `Debugger` β†’ `reg.exe unload` β†’ `reg.exe restore /f` (`REG_FORCE_RESTORE`) | | UI automation | `System.Windows.Automation` β€” `TogglePattern` on Real-Time / Tamper / Dev Drive protection toggles | | UAC bypass | Both `ConsentPromptBehaviorAdmin` and `PromptOnSecureDesktop` packed into single `UACStatus` DWORD, restored after toggle | | Overlay | Fullscreen multi-monitor WinForms, pulsing "PLEASE WAIT" label (sine-wave grey-to-white, 25 FPS) | | Cold boot detect | Volatile marker `HKCU\Software\Temp\WinDefCtl_Warmed` | ### Zero trace after `kill` - `wsftprm` service stopped + `DeleteService` - `%SystemRoot%\System32\drivers\kvckiller.sys` deleted - `%TEMP%\kk.cab` and `%TEMP%\Ifeo.hiv*` deleted - Only IFEO entries remain (intentional β€” that **is** the active block; `restore` clears them) ### Rebuild the script Download `generator.zip` (top of page), extract, run `build-ps.ps1`. Generator runs `makecab.exe`, base64-encodes the CAB into 76-char lines, substitutes into `template.ps1`. Pure inbox Windows tooling β€” no external dependencies. ### Limits vs C++ binary - Slower startup (~1.5 s PowerShell + .NET cold load vs ~200 ms native exe) - Requires `-ExecutionPolicy Bypass` or signed copy - Defender RTP **may** flag the script on disk (base64-encoded signed driver inside a `.ps1`); C++ binary embeds the same driver as ICO resource and sits below most heuristics - No Direct2D overlay β€” WinForms instead --- ## πŸ› οΈ Technical Requirements | | v2.0 C++ | v2.0 PS1 | v1.x | |---|---|---|---| | OS | Windows 11 | Windows 11 | Windows 11 | | Privileges | Administrator | Administrator | Administrator | | Dependencies | None (static CRT) | PowerShell 5.1+ / .NET | UI Automation, DWM | | Size | ~380 KB | ~65 KB | ~48 KB exe / ~23 KB ps1 | | Engine kill | βœ… IFEO + kvckiller.sys | βœ… IFEO + kvckiller.sys | ❌ | | RTP/TP control | βœ… | βœ… | βœ… | | Overlay | βœ… Direct2D | βœ… WinForms (pulsing) | ❌ (console) | | Compiler needed | Visual Studio 2022 | none (inbox tools) | none | --- ## πŸ“ž Contact & Support - **Email:** - **Phone:** +48 607-440-283 - **Website:** - **GitHub:** ### Donations - **PayPal:** paypal.me/ext1 - **Revolut:** revolut.me/marekb92 --- ## βš–οΈ Legal & Ethical Notice Intended for authorized security testing and system administration only. User assumes full legal responsibility. Ensure proper authorization before use on any system. --- **Copyright Β© 2026 Marek WesoΕ‚owski β€” WESMAR. All rights reserved.** ### Add a comment --- ## Navigation - Parent: [Repositories](https://kvc.pl/repositories.md) - Previous: [SignGuiPatcher β€” Windows Watermark Remover](https://kvc.pl/repositories/signguipatcher.md) - Next: [Notepad](https://kvc.pl/repositories/notepad.md)