[Selling] Kernel Driver - PowerShell - Injector - Memory Framework

[Mrokoui]

PRISM
Modular Kernel-Level Memory Framework
Bring your own hack. Prism handles the kernel.

[hr]

› What is Prism?

Prism is a professional-grade external framework for kernel-mode
memory operations. It ships with a custom kernel driver, a self-contained
kernel loader (no driver installation, test-signing mode, or driver-signature
enforcement bypass required), a standalone DLL injector, and a PowerShell binary module —
all wrapped in a portable WPF launcher.

Verified on Windows 10 22H2 (build 19045.x) and Windows 11 (builds 26100
and 26200) x64. Driver targets Win10 2004+ (build 19041+; uses
ExAllocatePool2). No installer, no hardcoded paths, no build-tools
or SDKs to install. Language: English or Polski, switchable in-app.

[hr]

› Components

• PrismKernel.sys — custom kernel driver (read, physical-read, scatter-read, write, APC injection, manual mapping, byte patching, allocation, whitelist) + stealth layer (page splitting)
• PrismMapper — self-contained kernel loader using a bundled BYOVD-based loading mechanism (signed vendor driver embedded internally — no user-supplied files, no test-signing mode or driver-signature enforcement bypass required)
• PrismInjector — standalone DLL injector using the kernel handle
• PrismShell — PowerShell binary module (17 typed cmdlets) + built-in EN/PL command reference via help english / help polish
• PrismLauncher — modern WPF UI with tiles, favorites, drag-drop, language switch, dark theme

[hr]

› Kernel Driver Capabilities

• Read — MmCopyVirtualMemory-based virtual memory read path
• Physical memory read — MmGetPhysicalAddress + MmMapIoSpace (does not go through the standard NtReadVirtualMemory / ReadProcessMemory path where anti-cheat userland instrumentation typically hooks)
• Scatter read — batch multiple (addr, size) pairs in one IOCTL round-trip (loop-based over MmCopyVirtualMemory — saves syscall/IRP overhead vs one call per address; not MDL-based DMA)
• Write paths — plain write IOCTL (address-range check on user VA); dedicated SEH-protected write paths (ProbeForWrite + __try/__except) on injection, manual-map, patch, module-stomp and auto-write
• Base address discovery — resolve process image base by PID (PsLookupProcessByProcessId + PsGetProcessSectionBaseAddress)
• Pattern scan — Search-PkPattern cmdlet reads target memory in chunks through the driver and scans the returned bytes client-side
• DLL injection — kernel-initiated APC (KeInsertQueueApc on an alertable target thread; target calls LoadLibraryW on wake). Additional kernel-initiated user thread mode (RtlCreateUserThread) available on Win10 22H2 and Win11 24H2; Win11 25H2 (26200+) is APC-only because ZwCreateThreadEx is no longer exported there.
• MMAP injection — full manual mapping via bundled Python mapper: allocates in target, copies sections, applies relocations, resolves IAT, calls DllMain — all through the driver's IOCTLs, no LoadLibraryW call, doesn't trigger the standard LoadImageNotify path
• Byte patching — dedicated PATCH IOCTL: ZwProtectVirtualMemory to RWX, backs up original bytes, writes under SEH, restores protection (32-byte cap)
• Kernel allocation — ZwAllocateVirtualMemory in target process address space
• Auto-write loops — kernel timer thread performs periodic writes without user-mode round trips
• Process whitelist — configurable process-name prefix (up to 15 chars, empty = off) enforced on the write-side IOCTLs (inject, mmap, patch, alloc, auto-write). Read / plain-write / base-lookup IOCTLs are unfiltered.
• Module load check — Wait-PkModuleLoaded polls Get-Process | Modules on an interval (default 500 ms) after injection to confirm the DLL landed
• Stealth — page splitting — fragments a large RWX allocation into individual 4 KB pages, optionally cycling per-page protections (RWX → RX → RW → RO); breaks the common "large contiguous RWX block" heuristic without unloading the payload

[hr]

› PowerShell Module — 17 typed cmdlets

    Connect-PkDevice          Disconnect-PkDevice       Get-PkBase
    Get-PkWhitelist           Set-PkWhitelist           Invoke-PkInject
    Invoke-PkPatch            New-PkAllocation          Read-PkMemory
    Read-PkScatter            Search-PkPattern          Start-PkAutoWrite
    Stop-PkAutoWrite          Update-PkAutoWrite        Test-PkModuleLoaded
    Wait-PkModuleLoaded       Write-PkMemory

Type help english or help polish any time for the full localized command reference (parameters, examples, pipeline notes). This is served by the Show-PkHelp helper function bundled with the shell — it reads the JSON strings tables shipped alongside the module. Plain Get-Help <cmdlet> shows only the auto-generated parameter syntax (no MAML XML help file ships with the binary module).

[hr]

› Injector

• Standalone .exe — works with or without the launcher
• Injection is fully kernel-initiated — no user-mode OpenProcess / CreateRemoteThread. APC mode (KeInsertQueueApc on an alertable target thread) always available. New kernel-initiated user thread mode (RtlCreateUserThread) on Win10 22H2 / Win11 24H2 only — Win11 25H2 (26200+) is APC-only.
• Manual-mapping mode via bundled Python mapper (allocates + copies + relocates + resolves IAT + calls DllMain directly through the driver's IOCTLs — doesn't trigger the standard image loader's LoadImageNotify path)
• Launcher's built-in Injector tab is EN/PL. The standalone PrismInjector.exe GUI is currently Polish-only (EN pass planned)
• Works on user-mode processes with anti-cheat modules loaded (physical-read IOCTL operates outside the standard user-mode memory-read path; does NOT elevate to PP/PPL Windows protection)

[hr]

› Launcher Features

• Modern dark-themed WPF interface
• Full EN / PL language switch (persisted per user)
• Tile-based tabs: Driver, Active, Favorites, Programs, Injector, PowerShell, Folders, Donate
• Drag-drop any .exe / .lnk / folder to add it to your library
• Live process detection (active tab shows what's currently running)
• All embedded binaries stage themselves on first use — no separate install step
• UAC elevation prompted per driver-loading operation (Verb=runas on the mapper). The PowerShell wrapper (PsRun.exe) is manifested requireAdministrator; parent Prism.exe runs asInvoker.
• No SDK / build-tools to install — the launcher and all its native components ship in the exe (optional MMAP injection mode uses Python 3, see Requirements below)

[hr]

› Portability

• Single portable Prism.exe (~11 MB, no installer) — self-stages on first launch
• Runs from any location — Desktop, USB, network share
• All paths resolved dynamically at runtime — no hardcoded install directories
• Works on any Windows username, any drive letter

[hr]

› Requirements

• Windows 10 version 2004 or newer (build 19041+) or Windows 11 x64
• Administrator privileges (kernel driver loading)
• .NET Framework 4.8 (preinstalled on all modern Windows)
• PowerShell 5.1 (ships with Windows, always available) — auto-upgrades to PowerShell 7 if installed
• Python 3 — only required if you use the optional MMAP injection mode; APC injection and every other feature work without Python
• Windows Defender / EDR temporarily disabled during driver load (re-enable after — Prism doesn't need it off at runtime)
• HVCI / Memory Integrity turned OFF (Windows Security > Device Security) while using Prism
• Windows Vulnerable Driver Blocklist turned OFF

[hr]

› Use Cases

• Kernel-mode security research
• Memory forensics and live analysis
• Game modding and offset discovery (private test environments)
• EDR / AV evasion research
• Custom driver development and testing
• Automated memory scanning pipelines

[hr]

› Pricing — Subscription Based

All tiers include free updates within the current major version.

┌───────────────────────────────────────────────────────────────┐
│ TIER        │ MONTHLY  │ QUARTERLY   │ YEARLY   │ LIFETIME   │
├───────────────────────────────────────────────────────────────┤
│ Standard    │  €35     │  €95  (-10%)│  €349    │     —      │
│ Pro         │  €80     │ €215  (-10%)│  €799    │  €1,699    │
│ Reseller    │ €249     │ €669   (-8%)│ €2,499   │     —      │
└───────────────────────────────────────────────────────────────┘

› Standard — full product, as-is

• Prism.exe launcher (EN/PL, portable, no installer)
• Kernel driver + manual mapper + injector + PowerShell module
• All 17 typed cmdlets + built-in EN/PL command reference (help english / help polish)
• Language switch, driver load-log window, drag-drop library
• Community support (24–48 h response)
• Free updates within current major version
• Whatever ships in Prism.exe today — no custom work, no upgrades

› Pro — Standard + integration service

• Everything in Standard
• Full IOCTL documentation for direct integration in C++, C#, Python, Rust
• Ready-made scripts and code samples (Python + C++ + PowerShell)
• Code adaptation service — I adapt your existing source code so it works with PrismKernel (up to 1 project per month)
• Priority support (12 h response)
• Beta access to new features
• Optional one-time Lifetime at €1,699 — never pay again

› Reseller — Pro + rebranding & OEM

• Everything in Pro
• Headless PrismLoader.exe — no GUI, no branding, ~200 KB — bundle it with your own product
• Full white-label rebuild — your logo, your name, your colors on the launcher; up to 2 rebuilds per month included
• OEM licensing — resell to your own customers under your own brand
• NDA available on request
• Direct developer contact (Telegram / Discord DM)
• Priority queue on kernel updates

› First-month discount for new customers

• Standard — €19 for first month (then €35)
• Pro — €49 for first month (then €80)

[hr]

› How to Buy

1. PM me first to discuss tier, timeline, and confirm availability
2. Sale is finalized via the elitepvpers Trade Request system
3. Choose payment method (see below)
4. After payment confirmation, download link + license key sent via PM within 24 h
5. Setup assistance included (PM me if driver won't load)

[hr]

› Payment Methods

• Cryptocurrency (preferred) — BTC / LTC / USDT (TRC-20 or ERC-20) / XMR
• SEPA bank transfer — EU only, 2–5 business days
• elite*gold — accepted, current market rate
• Middleman available on request (reputable epvp/UC MMs — highly recommended for first-time buyers)

Processing: crypto = 1 confirmation. SEPA = 2–5 business days.

[hr]

› Legal & Compliance

• Launcher, PrismKernel.sys driver, PrismMapper kernel loader, PowerShell binary module, standalone injector and Python MMAP mapper are all self-authored source you get updates on
• Kernel loader (PrismMapper) uses the standard BYOVD approach with a signed vendor driver bundled internally — no user-supplied files, no test-signing mode or driver-signature enforcement bypass required
• Uses documented Windows kernel APIs (MmCopyVirtualMemory, KeStackAttachProcess, MmGetPhysicalAddress / MmMapIoSpace, KeInsertQueueApc, ZwAllocateVirtualMemory / ZwProtectVirtualMemory)
• Buyer is responsible for how the tool is used on their systems
• Resellers are responsible for their own compliance with the target platform's Terms of Service
• Refunds: no refunds after license key delivery due to nature of digital product; test period available on request before purchase

[hr]

› Screenshots & Video

(Attached below — launcher UI, PowerShell tab with cmdlets, injector tab, driver-loaded state)

[hr]

› Support & Updates

• Response time: Standard 24–48 h · Pro 12 h · Reseller direct DM
• Bug fixes and stability updates: free for subscription duration
• Major feature releases: free within current major version
• Feature requests: prioritized for Pro and Reseller tiers

[hr]

› FAQ

Q: Do I need to supply any external driver or exploit?
No. PrismMapper and PrismKernel are both bundled inside Prism.exe. The
launcher extracts them on first driver load and handles everything
automatically. You need admin privileges, Defender temporarily off during
driver load, HVCI / Memory Integrity off, and (on Windows 11 22H2+) the
Vulnerable Driver Blocklist off — see the Requirements section above.

Q: Does it work with EAC / BE / Ricochet / Vanguard?
Prism gives you kernel-mode primitives. Whether they survive a specific
anti-cheat depends on your ESP/aim code, not Prism itself. Physical-read
IOCTL operates outside the standard NtReadVirtualMemory / ReadProcessMemory
path where anti-cheat userland instrumentation typically hooks. Tested
against EAC, BattlEye, X-Trap and HackShield userland modules. Not
ship-verified against Vanguard or Ricochet — different tier, boot-time
driver + aggressive HW telemetry.

Q: Can I write my ESP in Python instead of C++?
Yes. Either use the built-in PowerShell cmdlets, or open the driver
handle directly from Python via ctypes + DeviceIoControl. Full IOCTL
documentation is included in Pro and Reseller tiers.

Q: Can I see proof it works before buying?
Yes — video proof available on request (driver load, read, write, pattern
scan, log window with mapper output). DM me.

Q: Can I try before buying?
Yes — 1-hour trial license available on request.

[hr]

› Contact: dc: venv_ · Trade via elitepvpers Trade Request

[Sheintan]

Hey, got a few technical questions.

1. Which Win10/11 builds have u actually tested this on? “Any Win10/11 x64” is a pretty big claim.

2. For the mapper, u say BYOVD via user-supplied vulnerable driver. So I need to provide my own vuln driver, right? Which ones are supported?

3. Is PrismKernel.sys actually your own driver/code or is any part of the kernel side based on public projects?

4. Can u show the IOCTL interface/header or at least some proof of the driver implementation? Don’t need the full source obviously.

5. What exactly do u mean by “works on protected processes”? Which protection levels have u tested?

6. U mention APC LoadLibraryW + manual mapping. Are these 2 completely separate injection modes?

7. U say zero external dependencies, but the mapper needs a user-supplied vuln driver. What exactly is included in the 45MB exe and what do I need to provide myself?

Not trying to be annoying, just wanna verify what I’m using before I run a kernel driver as admin lol.

[Mrokoui]

Hey.

1) Win10 22H2 (19045.x), Win11 26100, Win11 26200 — those I actually tested. Driver targets Win10 2004+ (ExAllocatePool2), so anything from build 19041 up should work, just not ship-verified.

2) OP line is outdated — you supply nothing, mapper is self-contained.

3) Both my own C — .sys and mapper. Standard MSDN APIs on the driver side, standard BYOVD approach on the mapper with a signed vendor driver bundled.

4) DM me — I'll send PrismKernel.h. Short demo clip on request.

5) Standard user-mode game processes with AC loaded. Tested against EAC, BattlEye, X-Trap, HackShield. Physical-read IOCTL sidesteps userland ntdll hooks; stealth layer on top (page splitting). Does NOT touch PP/PPL. HVCI off at load, VDB off on Win11 22H2+.

6) Yes, two separate modes in the injector UI.

7) In the ~11 MB exe: driver, mapper, injector, PS module, launcher, Python mapper for MMAP, EN/PL strings. You bring: admin, Defender off during driver load, HVCI off, VDB off on Win11 22H2+, own DLL if injecting. Python 3 only for MMAP.

Beta — tested on my own machine. If you hit issues, gets patched, access extended.