0xM0nCrush — a tool for terminating Windows processes from kernel mode

A Rust tool for terminating selected Windows processes using a signed vulnerable driver. The user-mode component retrieves the PID of each target process and passes it to the MonProcessEX.sys driver via tht IOCTL 0x22400C control code.

Features: • Terminates processes from kernel mode using the signed HONOR driver. • Works on Windows 10/11 without kernel offsets, PDB files, and build-specific shellcode. • Supports PPL protection bypass, command-line execution, and automatic service installation, unloading, and removal through the Windows Service Control Manager. • Self-deletion using --self-destruct. • JSON-formatted output.

Tool: https://github.com/DeathShotXD/0xM0nCrush