roak

A powerful windows 10/11 rootkit

features

terminate_process(pid, status); // forcefully terminates the target process ID with a custom exit code

elevate_process(pid); // elevates the target process to system

protect_process(pid); // sets process to system, enables PPL, hides threads from debugger

elevate_handle(pid, handle, bits); // elevates a handle inside a processes object table

disable_enable_callbacks(enable, mask); // toggle kernel callbacks for process, image, thread creation/removal