Dual-stream (double-buffer) transparent file encryption — a Windows minifilter research driver.
Each protected .txt file gets two views: Plaintext for applications and cache-manager I/O, Shadow for encrypted bytes on disk. The filter transforms at the boundary; stop the driver and only ciphertext remains.
Use only on systems you own or are authorized to test. Research and learning only — not for production data protection.
On-disk encrypt/decrypt uses XOR (HawkCipher.c) to keep the implementation simple and easy to study.
- OS: Windows 10 or Windows 11, x64
- Privileges: Administrator (driver install and start)
- Build (from source only): Visual Studio 2019 or later with Windows Driver Kit (WDK) 10
- Load: test-signed driver (
CN=HawkeyeTfe Test) or your own signing pipeline — not WHQL
Test-signed builds require test signing mode (bcdedit /set testsigning on) and trusting the test certificate. Secure Boot and Memory Integrity (HVCI) may still block loading on some machines.
-
Get the driver (pick one):
- Release (recommended): download the latest Windows x64 zip from Releases and extract. The folder contains
HawkeyeTfe.sys,HawkeyeTfe_Test.cer, and four.batfiles. - From source: build Debug or Release | x64 in Visual Studio (
HawkeyeTfe.sln). Post-build signs the driver and copiesHawkeyeTfe.sysandHawkeyeTfe_Test.cerintoscripts\.
All steps below assume you are in the folder that contains
HawkeyeTfe.sysandinstall.bat. - Release (recommended): download the latest Windows x64 zip from Releases and extract. The folder contains
-
On the target machine (admin, once before first load):
Enable test signing (reboot required):
bcdedit /set testsigning on shutdown /r /t 0Right-click
HawkeyeTfe_Test.cer→ Install Certificate → Local Machine (admin) → Trusted Root Certification Authorities.
Repeat once → Trusted Publishers. -
Install and start (from the folder that contains
HawkeyeTfe.sys):install.bat start.batinstall.batcopiesHawkeyeTfe.sysfrom its own directory to%SystemRoot%\System32\drivers\.
On first load the driver createsC:\test_filesautomatically. -
Under
C:\test_files, create or edit.txtfiles.
Current scope: only.txtunder the protected path is transformed (HawkIsProtectedTxtFile).
Verified editors: Windows Notepad and Notepad++ — open, edit, and save work transparently; on-disk bytes stay encrypted. -
Stop or remove:
stop.bat uninstall.bat
Release zip layout: flat folder — HawkeyeTfe.sys, HawkeyeTfe_Test.cer, install.bat, start.bat, stop.bat, uninstall.bat. No Visual Studio required on the target machine. After a local build, the same files appear under scripts\.
Encrypt an existing plaintext file: copy a .txt into C:\test_files while the driver is running, open it in Notepad or Notepad++, and save once (even unchanged). The on-disk copy becomes ciphertext; with the driver stopped you can confirm the raw bytes are no longer plain text.
After you have a protected .txt under C:\test_files:
- With the driver running — open it in Notepad or Notepad++: you see plaintext.
- Run
stop.bat— open the same file again (or view raw bytes with a hex editor): you see ciphertext on disk. - Run
start.bat— the file reads as plaintext again.
Plaintext while loaded, ciphertext while stopped — that closed loop means transparent encrypt/decrypt is working.
Driver running (start.bat) |
Driver stopped (stop.bat) |
|---|---|
| Notepad shows readable text while the filter is loaded. | Raw on-disk bytes after stop.bat (Notepad opens the file without transform). |
Each protected file uses a dual-stream (double-buffer) model:
| Stream | FILE_OBJECT |
Role |
|---|---|---|
| Plaintext | PlaintextFileObject |
Filter-synthesized view for apps; bound to HAWK_SCB, cache-manager I/O on plaintext |
| Shadow | ShadowFileObject |
Real lower-stack open; on-disk bytes are ciphertext |
Create opens both. Read/write on the Plaintext stream are transformed at the filter boundary (decrypt on read, encrypt on write). Flush and other metadata I/O are forwarded to the Shadow handle without transform.
What works today — everything else is untested or unchanged:
| Item | Today |
|---|---|
| Protected path | C:\test_files only (HAWK_DEFAULT_PROTECT_PATH; change in HawkeyeTfe.h and rebuild) |
| File type | .txt under that path |
| Editors | Notepad, Notepad++ |
Other extensions, applications, and paths are not transformed. Back up .txt files before trying new tools or build experiments — the driver sits on the cache-manager path.
Email hawkeye18485@gmail.com. For driver load failures, include Windows build, signing mode, and sc query HawkeyeTfe output.
To report a security vulnerability, see SECURITY.md — do not open a public issue.
GPL-3.0-or-later. See LICENSE. The minifilter driver in this repository is licensed under the same terms.
Hawkeye Lab — the author's commercial game anti-cheat research console (Windows kernel–level detection and analysis). Hawkeye TFE is unrelated open research (file encryption); if your focus is game security and cheat detection, see Lab instead.