// the find
un4ckn0wl3z/dioprocess-private
DioProcess — Advanced Windows Internals, Evasion, Rootkit, Hypervisor, SMM & Bootkit Research Framework
A Windows internals research framework that spans the full privilege hierarchy — usermode process manipulation, a WDM kernel driver, an Intel VT-x hypervisor (Ring -1), and UEFI SMM drivers (Ring -2) — all controlled through a Rust/Dioxus desktop GUI. Built for malware researchers, reverse engineers, and red teamers who want to study or demonstrate techniques from process injection up through firmware-level memory access. The scope is unusually ambitious for an open-source project with 10 stars.
The SMM layer is the most interesting part: a DXE bridge driver publishes a shared memory address via NVRAM, the kernel driver reads it and triggers an SMI, and the SMM handler does the actual physical memory read/write — and they ship pre-built OVMF firmware with it embedded so you can test in QEMU without touching real hardware. The EPT hook scripting system (.dph files) uses module+offset addressing that survives ASLR across process restarts, which is the right call for a repeatable research workflow. The Cargo workspace is cleanly separated by concern — network, service, process, callback, smm, misc — so the unsafe Win32 plumbing stays isolated from the Dioxus UI layer. Seven DLL injection techniques implemented in one place, covering everything from classic LoadLibrary through manual mapping, is a useful reference even if you only need one.
Only formally tested on Windows 10 22H2 (build 19045) — kernel structure offsets for EPROCESS, TOKEN, and PEB parsing are version-sensitive, and Windows 11 support is described as untested rather than unsupported, which is a meaningful distinction when your tool directly pokes kernel memory. Zero automated tests; the README says so explicitly, and for a tool where a wrong offset crashes the machine that matters. The SMM features on real hardware require flashing modified UEFI firmware, which risks a permanent brick without a CH341A SPI programmer to recover — this cuts the realistic user base of the flagship feature to nearly zero. The project is effectively undiscovered at 10 stars with no evidence of community testing, so edge cases and crashes are catching nobody's attention.