NYP Introduction core

NYP Kernel Framework provides advanced kernel-level security and driver development capabilities for Windows systems. This comprehensive guide covers kernel32 APIs, driver development, process hacking, and advanced memory manipulation techniques for security research.

Ring 0Kernel
kernel32Win32
Drivers.sys
SecurityProtection
ProcessHacking
MemoryManagement

Kernel vs User Mode

User Mode (Ring 3)

Applications, games, anti-cheat

Kernel Mode (Ring 0)

Drivers, OS core, hardware

Hyperion (Byfron)

Anti-cheat protection

Kernel32 API win32

Kernel32.dll provides core Windows API functions for process management, memory manipulation, and thread creation. Essential for NYP framework development.

kernel32 API
// Core kernel32 functions for NYP
// Process Management
HANDLE OpenProcess(DWORD dwDesiredAccess, BOOL bInheritHandle, DWORD dwProcessId);
BOOL CloseHandle(HANDLE hObject);
DWORD GetProcessId(HANDLE Process);
BOOL TerminateProcess(HANDLE hProcess, UINT uExitCode);
// Memory Management
LPVOID VirtualAllocEx(HANDLE hProcess, LPVOID lpAddress, SIZE_T dwSize, DWORD flAllocationType, DWORD flProtect);
BOOL VirtualFreeEx(HANDLE hProcess, LPVOID lpAddress, SIZE_T dwSize, DWORD dwFreeType);
BOOL VirtualProtectEx(HANDLE hProcess, LPVOID lpAddress, SIZE_T dwSize, DWORD flNewProtect, PDWORD lpflOldProtect);
// Process Memory
BOOL ReadProcessMemory(HANDLE hProcess, LPCVOID lpBaseAddress, LPVOID lpBuffer, SIZE_T nSize, SIZE_T *lpNumberOfBytesRead);
BOOL WriteProcessMemory(HANDLE hProcess, LPVOID lpBaseAddress, LPCVOID lpBuffer, SIZE_T nSize, SIZE_T *lpNumberOfBytesWritten);
// Thread Management
HANDLE CreateRemoteThread(HANDLE hProcess, LPSECURITY_ATTRIBUTES lpThreadAttributes, SIZE_T dwStackSize, LPTHREAD_START_ROUTINE lpStartAddress, LPVOID lpParameter, DWORD dwCreationFlags, LPDWORD lpThreadId);
DWORD WaitForSingleObject(HANDLE hHandle, DWORD dwMilliseconds);
// Module Management
HMODULE GetModuleHandle(LPCSTR lpModuleName);
FARPROC GetProcAddress(HMODULE hModule, LPCSTR lpProcName);
HMODULE LoadLibraryA(LPCSTR lpLibFileName);
1
OpenProcess

Obtains handle to target process

2
VirtualAllocEx

Allocates memory in target process

3
WriteProcessMemory

Writes to allocated memory

4
CreateRemoteThread

Creates remote thread execution

Driver Development kmd

Kernel Mode Drivers (KMD) run in Ring 0 with full hardware access. Used for security research, process protection, and system call interception.

Kernel Driver - C++
// NYP Kernel Driver Entry
#include <ntddk.h>
VOID DriverUnload(PDRIVER_OBJECT DriverObject) {
    DbgPrint("NYP Driver Unloaded\n");
}
NTSTATUS DeviceControl(PDEVICE_OBJECT DeviceObject, PIRP Irp) {
    PIO_STACK_LOCATION stack = IoGetCurrentIrpStackLocation(Irp);
    ULONG code = stack->Parameters.DeviceIoControl.IoControlCode;
    switch (code) {
        case 0x800: break;
        case 0x801: break;
        case 0x802: break;
    }
    return STATUS_SUCCESS;
}
NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath) {
    DbgPrint("NYP Driver Loaded\n");
    DriverObject->DriverUnload = DriverUnload;
    PDEVICE_OBJECT DeviceObject;
    UNICODE_STRING DeviceName = RTL_CONSTANT_STRING(L"\\Device\\NYP");
    IoCreateDevice(DriverObject, 0, &DeviceName, FILE_DEVICE_UNKNOWN, 0, FALSE, &DeviceObject);
    DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = DeviceControl;
    return STATUS_SUCCESS;
}
IRP Handling

Intercept I/O Request Packets

Device Comm

User-kernel communication

Memory Access

Physical memory manipulation

Process Hacking mem

Process hacking techniques for security research and analysis.

Process Discovery
// Find target process
DWORD FindProcess() {
    HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    PROCESSENTRY32 entry = { sizeof(PROCESSENTRY32) };
    if (Process32First(snapshot, &entry)) {
        do {
            if (_stricmp(entry.szExeFile, "target.exe") == 0) {
                return entry.th32ProcessID;
            }
        } while (Process32Next(snapshot, &entry));
    }
    return 0;
}
HANDLE OpenTargetProcess(DWORD pid) {
    return OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);
}
Enumeration

Find processes using Toolhelp32Snapshot

Access

Open with PROCESS_ALL_ACCESS

Memory Management vm

Memory management in kernel mode for security research.

Memory Operations
// NYP Memory Manager
class MemoryManager {
public:
    template<typename T>
    T Read(HANDLE hProcess, void* address) {
        T value;
        SIZE_T bytesRead;
        ReadProcessMemory(hProcess, address, &value, sizeof(T), &bytesRead);
        return value;
    }
    template<typename T>
    bool Write(HANDLE hProcess, void* address, T value) {
        DWORD oldProtect;
        VirtualProtectEx(hProcess, address, sizeof(T), PAGE_EXECUTE_READWRITE, &oldProtect);
        SIZE_T bytesWritten;
        bool result = WriteProcessMemory(hProcess, address, &value, sizeof(T), &bytesWritten);
        VirtualProtectEx(hProcess, address, sizeof(T), oldProtect, &oldProtect);
        return result;
    }
};
Pattern Scanning

Find memory signatures

Writing

Write with protection handling

Advanced Injection dll

Advanced injection techniques for security research.

Manual Mapping
// Manual DLL Mapping
bool ManualMapInject(HANDLE hProcess, const char* dllPath) {
    std::vector<uint8_t> dllData = ReadFile(dllPath);
    PIMAGE_DOS_HEADER dos = (PIMAGE_DOS_HEADER)dllData.data();
    PIMAGE_NT_HEADERS nt = (PIMAGE_NT_HEADERS)(dllData.data() + dos->e_lfanew);
    LPVOID base = VirtualAllocEx(hProcess, nullptr, nt->OptionalHeader.SizeOfImage, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
    WriteProcessMemory(hProcess, base, dllData.data(), nt->OptionalHeader.SizeOfHeaders, nullptr);
    PIMAGE_SECTION_HEADER section = IMAGE_FIRST_SECTION(nt);
    for (int i = 0; i < nt->FileHeader.NumberOfSections; i++) {
        if (section[i].SizeOfRawData) {
            LPVOID dest = (BYTE*)base + section[i].VirtualAddress;
            LPVOID src = dllData.data() + section[i].PointerToRawData;
            WriteProcessMemory(hProcess, dest, src, section[i].SizeOfRawData, nullptr);
        }
    }
    return true;
}
1
LoadLibrary

Standard injection

2
Manual Mapping

Without Windows loader

3
APC Injection

Async Procedure Calls

Kernel Hooks ssdt

Kernel hooks for system call interception and security monitoring.

SSDT Hook
// SSDT Hook Implementation
#include <ntddk.h>
extern PSSDT KeServiceDescriptorTable;
NTSTATUS (*OriginalNtOpenProcess)(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, PCLIENT_ID);
NTSTATUS HookedNtOpenProcess(PHANDLE ProcessHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PCLIENT_ID ClientId) {
    return OriginalNtOpenProcess(ProcessHandle, DesiredAccess, ObjectAttributes, ClientId);
}
void InstallSSDTHook() {
    ULONG index = 0x72;
    PVOID* target = &KeServiceDescriptorTable->ServiceTableBase[index];
    OriginalNtOpenProcess = (NTSTATUS(*)(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, PCLIENT_ID))*target;
    ULONG old;
    __writecr0(__readcr0() & ~0x10000);
    *target = HookedNtOpenProcess;
    __writecr0(__readcr0() | 0x10000);
}
SSDT Hooks

System service calls

Inline Hooks

JMP instructions

Anti-Cheat Bypass bypass

Detection

Anti-cheat scanning

Bypass

Kernel drivers, manual mapping

Protection

Hide and spoof

Bypass Implementation
// NYP Anti-Cheat Bypass
class AntiCheatBypass {
private:
    HANDLE hDevice;
    bool HideProcess(DWORD pid) {
        struct { DWORD pid; bool hide; } input = { pid, true };
        DWORD bytesReturned;
        DeviceIoControl(hDevice, IOCTL_HIDE_PROCESS, &input, sizeof(input), nullptr, 0, &bytesReturned, nullptr);
        return true;
    }
public:
    bool Initialize() {
        hDevice = CreateFile("\\\\.\\NYP", GENERIC_READ | GENERIC_WRITE, 0, nullptr, OPEN_EXISTING, 0, nullptr);
        if (hDevice == INVALID_HANDLE_VALUE) return false;
        HideProcess(GetCurrentProcessId());
        return true;
    }
};
Warning

For educational and research purposes only.

NYP Architecture design

NYP architecture layers: user-mode interface, kernel-mode driver, hardware abstraction.

User AppUI
IOCTLControl
KernelRing 0
HardwareCPU/Memory
1
User Mode

React UI, communicates via IOCTL

2
IOCTL

DeviceIoControl calls

3
Kernel Driver

Processes requests, hooks

C++ Module native

C++ primary language for kernel driver development.

C++ Kernel Module
// NYP C++ Kernel Module
#include <ntddk.h>
#include <intrin.h>
class NYP {
private:
    PDEVICE_OBJECT DeviceObject;
    UNICODE_STRING DeviceName;
    bool ReadKernelMemory(PVOID address, PVOID buffer, SIZE_T size) {
        MmCopyMemory(buffer, address, size, MM_COPY_MEMORY_PHYSICAL);
        return true;
    }
    bool WriteKernelMemory(PVOID address, PVOID buffer, SIZE_T size) {
        ULONG cr0 = __readcr0();
        __writecr0(cr0 & ~0x10000);
        memcpy(address, buffer, size);
        __writecr0(cr0);
        return true;
    }
public:
    NTSTATUS Initialize(PDRIVER_OBJECT DriverObject) {
        RtlInitUnicodeString(&DeviceName, L"\\Device\\NYP");
        IoCreateDevice(DriverObject, 0, &DeviceName, FILE_DEVICE_UNKNOWN, 0, FALSE, &DeviceObject);
        DriverObject->MajorFunction[IRP_MJ_CREATE] = DispatchCreate;
        DriverObject->MajorFunction[IRP_MJ_CLOSE] = DispatchClose;
        DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = DispatchControl;
        return STATUS_SUCCESS;
    }
    static NTSTATUS DispatchCreate(PDEVICE_OBJECT DeviceObject, PIRP Irp) {
        Irp->IoStatus.Status = STATUS_SUCCESS;
        IoCompleteRequest(Irp, IO_NO_INCREMENT);
        return STATUS_SUCCESS;
    }
    static NTSTATUS DispatchClose(PDEVICE_OBJECT DeviceObject, PIRP Irp) {
        Irp->IoStatus.Status = STATUS_SUCCESS;
        IoCompleteRequest(Irp, IO_NO_INCREMENT);
        return STATUS_SUCCESS;
    }
    static NTSTATUS DispatchControl(PDEVICE_OBJECT DeviceObject, PIRP Irp) {
        PIO_STACK_LOCATION stack = IoGetCurrentIrpStackLocation(Irp);
        ULONG code = stack->Parameters.DeviceIoControl.IoControlCode;
        switch (code) {
            case 0x800: break;
            case 0x801: break;
        }
        Irp->IoStatus.Status = STATUS_SUCCESS;
        IoCompleteRequest(Irp, IO_NO_INCREMENT);
        return STATUS_SUCCESS;
    }
};

Rust Driver safe

Rust provides memory safety for kernel driver development.

Rust Kernel Driver
// NYP Rust Driver
#![no_std]
#![no_main]
use kernel::prelude::*;
struct NYP {
    device: Pin<Box<Device>>,
}
impl Module for NYP {
    fn init() -> Result<Self> {
        let device = Device::new("NYP")?;
        Ok(NYP { device: Box::pin(device) })
    }
}
struct SafeMemory<'a> {
    process: Process<'a>,
}
impl<'a> SafeMemory<'a> {
    fn read<T: Copy>(&self, address: usize) -> Result<T> {
        let mut value: T = unsafe { std::mem::zeroed() };
        self.process.read_memory(address, &mut value, std::mem::size_of::<T>())?;
        Ok(value)
    }
}
Memory Safety

Ownership system

Performance

Zero-cost abstractions

NYP Tools debug

Essential tools for kernel development and debugging.

WinDbg

Debugger

VS

IDE + WDK

Verifier

Testing

IDA Pro

Disassembler

Cheat Engine

Scanner

Process Hacker

Manager

Driver Deployment build

Deploying kernel drivers requires signing and loading.

1
Build
msbuild nyp.vcxproj /p:Configuration=Release
2
Sign
signtool sign /fd SHA256 nyp.sys
3
Load
sc create NYP type= kernel binPath= nyp.sys

NYP Security prot

NYP security protects against detection and reverse engineering.

PatchGuard

Windows protection

Signing

WHQL certification

Integrity

Verification

Security Warning

Test in VM. Use proper signing.

Luau Integration script

Luau integration for script execution via kernel.

Luau Script
-- NYP Luau Script
local function GetAddress(obj)
    return nyp.get_real_address(obj)
end
local function WriteMemory(addr, value, size)
    return nyp.write_memory(addr, value, size)
end
local function ReadMemory(addr, size)
    return nyp.read_memory(addr, size)
end
local Players = game:GetService("Players")
local LocalPlayer = Players.LocalPlayer
local humanoid = LocalPlayer.Character.Humanoid
local addr = GetAddress(humanoid.Health)
local health = ReadMemory(addr, 4)
print("Health:", health)
WriteMemory(addr, 100, 4)
print("Modified!")

NYP Community resources

NYP community resources for learning and collaboration.

Docs
  • MSDN WDK
  • OSR Online
Forums
  • OSR NTDEV
  • UnknownCheats
Open Source
  • NYP Kernel
  • Celestra