A comprehensive hypervisor-based antivirus solution that combines kernel-level file system monitoring, YARA pattern matching, and Intel VMX virtualization technologies to provide multi-layered protection against malware and security threats.
This project was developed as my graduation project, demonstrating advanced Windows kernel development, hypervisor technology, and cybersecurity concepts. KernelLover-AV implements a defense-in-depth security approach using cutting-edge technologies including VMX hypervisor, kernel mini-filter drivers, and real-time malware detection.
KernelLover-AV follows a layered security architecture with components operating in both kernel and user modes:
┌─────────────────────────────────────────────────────────┐
│ User Mode │
├─────────────────┬─────────────────┬─────────────────────┤
│ ControlFilterApp│ TheCYaraAgent │ HypervisorUsermode │
├─────────────────┼─────────────────┼─────────────────────┤
│ Kernel Mode │
├─────────────────┬─────────────────┬─────────────────────┤
│FileMonitorMini- │ File │ HypervisorTest │
│ Filter │ System │ │
└─────────────────┴─────────────────┴─────────────────────┘
- FileMonitorMiniFilter: Kernel-mode mini-filter driver that intercepts file system operations
- Real-time file operation analysis and policy enforcement
- Pre/post-operation callbacks for comprehensive monitoring
- TheCYaraAgent: Pattern matching engine for malware detection
- Dynamic YARA rule updates and management
- High-performance scanning with comprehensive rule database
- HypervisorTest: Kernel-mode hypervisor leveraging Intel VMX
- HypervisorUsermode: User-mode control interface
- Hardware-level isolation and monitoring capabilities
- Extended Page Tables (EPT) and VM control structures
“I designed the hypervisor with the goal of using EPT for API hooking. The current version supports single-core virtualization, and I’m still building toward full EPT support.”
- ControlFilterApp: Unified management interface
- Component coordination and configuration
- Event logging and system monitoring
- File System Layer: Intercepts and analyzes all file operations
- Pattern Matching Layer: Identifies known malware signatures using YARA
- Virtualization Layer: Provides hardware-level isolation and containment
- YARA Rule-Based Detection: Security policies are enforced through loaded YARA rules
- Dynamic Rule Management: Rules can be updated and managed through the control application
- Configurable Detection Patterns: Flexible pattern matching based on current rule set
- Hardware-assisted security through Intel VMX
- Configurable security policies and rules
- x64 architecture support
- Comprehensive logging and monitoring
- Windows development environment with WDK (Windows Driver Kit)
- Intel processor with VMX support (for hypervisor functionality)
- Administrative privileges for driver installation
- Visual Studio with kernel development tools
- Build the solution using Visual Studio with WDK
- Install the kernel drivers using appropriate signing certificates
- Deploy the user-mode applications
- Configure YARA rules and security policies
- Start the ControlFilterApp as administrator
- Configure file monitoring policies
- Update YARA rule database
- Enable hypervisor protection (if supported)
- Monitor system events and security alerts
- OS: Windows 10/11 (x64 recommended)
- Processor: Intel with VMX support (for full functionality)
- Memory: Minimum 4GB RAM
- Privileges: Administrator rights required
- Development: Visual Studio + WDK for building from source
- Mini-filter driver development
- IOCTL communication between kernel and user modes
- Inverted call patterns and asynchronous I/O
- Cancel-safe IRP handling
- Intel VMX technology integration
- Extended Page Tables (EPT) management
- VM exit handling and control structures
- Hardware-assisted security monitoring
- Real-time threat detection
- Pattern matching algorithms
- File system security policies
- Multi-layered defense mechanisms
- Architecture: Detailed system design and component interactions
- Components: In-depth technical specifications for each module
- Implementation: Code structure and development guidelines
- Deployment: Installation and configuration procedures
- This software requires kernel-level access and should be used with caution
- Proper driver signing is required for production deployment
- Hypervisor functionality currently works only in single-core OS environments
- Administrative privileges are mandatory for all operations
- The file monitoring and YARA detection components work reliably in all environments
- Future updates will enhance hypervisor compatibility for multi-core systems
This graduation project demonstrates:
- Advanced Windows kernel development skills
- Understanding of hypervisor and virtualization technologies
- Implementation of enterprise-grade security solutions
- Integration of multiple complex systems and technologies
- Real-world application of cybersecurity principles
See a full overview on the architecture and how my project works at this link: https://deepwiki.com/OmarShehata11/KernelLover
This project was developed for educational purposes as a graduation project. Please ensure compliance with all applicable laws and regulations if using or modifying this code.
Note: This is an educational project developed to demonstrate advanced kernel programming and cybersecurity concepts. Use responsibly and ensure proper testing in isolated environments.