valeraintech / valerain-ark

🔭This will be my first long-term update project, and vAlerainArk is committed to helping security personnel with testing.

vAlerain-Ark(A C++based Ark aimed at solving security personnel issues)

English | 简体中文 | 繁體中文

Ark是Anti-Rootkit（对抗恶意程序）的简写, vAlerainArk目标成为逆向工程师、编程人员的工具，同时也能为那些希望清理恶意软件的用户服务。 以后也将会支持更多功能和命令。

F&Q

What can I use your ark for?

My Ark currently has relatively few functions that can be implemented, only managing processes and services, as well as hook, dump, and other functions that will be implemented soon.

How do you consider the future when your functionality is so advanced?

Although I also know that our features are limited, they will gradually update, such as innovating by removing PPLs and preventing drivers from turning on and off, and my drivers are written too junk and ready for refactoring.

What was your original intention for developing Ark?

At first, the author liked to use the Velvet Sword, but later it was taken down. As the author was studying the Windows kernel and preparing to write an ark to understand the kernel and pagination, this project was created.

1.0.0.3

• Using snapshots to enumerate process lists
• Use process ID to end the process
• Use process PID to end the process tree
• Can recognize process handles

1.0.0.2

• Optimized startup animation
• Support ending, freezing, and ending process trees, viewing process paths, and copying process information
• Support replication of service name and registry information
• Support reading, viewing, and modifying Windows file associations
• Support for enumeration and operation of Windows service driver registry
• Windows message hook, mouse and keyboard hook testing and callback
• Support checking windowsPE structure file analysis
• Support Windows local proxy changes

1.0.0.1

• Optimized startup animation
• Support for ending, freezing, and ending process trees, viewing process paths, and copying process information for processes
• Support for reading, viewing, and modifying Windows file associations
• Enumeration and operation support for the registry of Windows service drivers
• Hook testing and callback for Windows message hooks, mouse and keyboard
• Support checking windowsPE structure file analysis
• Support for Windows local proxy changes

v1.0.0.0

• Support for ending, freezing, and ending process trees, viewing process paths, and copying process information for processes
• Support for reading, viewing, and modifying Windows file associations
• Enumeration and operation support for the registry of Windows service drivers
• Hook testing and callback for Windows message hooks, mouse and keyboard
• Support checking windowsPE structure file analysis
• Support for Windows local proxy changes

The source code usage standard is based on C++17

We strongly recommend using CLion compilation, and you can also use Microsoft's VS but never use dev cpp.

Special thanks

• CLion's technical support
• vAlerain Develop;Code from Mr. vAlerain;
• Long term evaluation and repair of SNbing54

valerain-ark's Issues

文件夹命名不明，不确定如何编译该项目

该项目目前的代码文件较为混乱，原以为不同版本的代码会放置在 Source-code 文件夹下的对应版本目录内，但是最近一次的代码提交却是 Preview-version 目录下的文件，能否指导一下当前最新版本的代码放在什么地方？如何编译？

另外，整个项目除了 CMakeLists.txt 都没有引用 Header-file 内的内容，也不确定在项目中发挥什么作用，能否解释一下该目录存在的意义？

The initial opening speed of the software is too slow compared to Windows Taskmgr

The initial opening speed of the software is too slow compared to Windows Taskmgr

I think you can made a GUI for this project.

I think you can made a GUI for this project.