VMwareHardenedLoader-ng is a Windows kernel driver for VMware guest research environments. It filters selected VMware-related firmware strings and blocks selected VMware PnP registry enumeration.
The driver resolves undocumented kernel globals from signed System Informer KPH dynamic data instead of PDBs, signature scanning, or registry-provided RVAs.
Read the build guide, then build from a Visual Studio 2022 Developer Command Prompt with the WDK installed:
msbuild VmLoader.sln /m /t:Rebuild /p:Configuration=Release /p:Platform=x64The build downloads and validates the KPH manifest, generates and signs v20 dynamic data, and publishes the runtime artifacts needed by the install scripts. See runtime loading before configuring external dynamic data or loading the driver.
- Windows 10 and Windows 11 x64 or ARM64 guests
The maintained configurations are Release|x64, Debug|x64, Release|ARM64, and Debug|ARM64. ARM64 runtime behavior still depends on undocumented kernel layouts and must be validated on the target Windows build.
- Quick start: install, test-sign, and uninstall
- Build requirements and dynamic data
- Runtime loading and external dynamic data
- Driver behavior, test signing, and VMware configuration
- Troubleshooting, limitations, and dependencies
Released under the MIT License. See LICENSE.
System Informer is included as a submodule for KPH dynamic data and the CustomBuildTool and CustomSignTool utilities.
kphtools provides the symbol source and RVAs for nt!ExpFirmwareTableResource and nt!ExpFirmwareTableProviderListHead.