Hydra Dragon Antivirus

WARNING: Highly outdated documenation here but for reference I keep it.

Other than OpenEDR, MBRFilter, Sanctum etc. directories are fully deperecated for performance.

📚 For detailed documentation, architecture diagrams, and component guides, visit our Project Wiki.
🎥 POC: https://www.youtube.com/watch?v=2ZxJmZ3XTEM&t

WARNING: ACTIVE DEVELOPMENT IN PROGRESS

This project is not production-ready. Breaking changes, bugs, and incomplete features should be expected.

⚠️ NOTICE: This repository is intended strictly for EXPERT MALWARE ANALYSTS and SECURITY RESEARCHERS. It contains low-level system components and experimental security drivers that require professional knowledge to handle safely.

[!CAUTION]

🛑 USER LIABILITY & SAFEGUARD LIMITATIONS

HydraDragon is designed to protect against malicious automated threats, not human error or intentional system modifications.

1. Manual Deletion: The antivirus WILL NOT stop you from running commands like rd C: /s /q or manually deleting your own files. It recognizes that if you (the Administrator) are explicitly deleting something, it is a real user mistake rather than a malware intrusion. The system is designed to permit intentional administrative decisions without interference.
2. Driver/System Misconfiguration: The software does not protect against manual installation of incompatible drivers or incorrect system settings. A "Inaccessible Boot Device" or other system failures caused by manual registry edits or driver experiments are NOT considered malware behavior and are not blocked.
3. Experimental Nature: You are responsible for any data loss or system instability caused by using this experimental software. Always test in a Virtual Machine (VM) first.

POC

• 📺 Proof of Concept (POC) Video: https://www.youtube.com/watch?v=2ZxJmZ3XTEM&t

• Demo: https://hydradragonantivirus.github.io/HydraDragonAntivirus/

One Man Project

• HydraDragon is a three-year independent open-source antivirus/EDR project built primarily by one developer.

TODO

• Add HydraDragonIDE to project (static analyzer).
• Remove Npcap since it's not really open source and replace with custom Suricata build.

About Feature Of Project

• I said this about month ago: NOTE: This project is become far more complex than you think so I switched to Android to join AV-Test to become first open source antivirus which going to join professional tests: https://github.com/HydraDragonAntivirus/HydraDragonAV-Mobile
• Then this UPDATE: I was planning to use only best signatures and remove a lot of dynamic analysis based antivirus with only Owlyshield + OpenEDR + Firewall because in real world we need to focus real-time-protection without heavy signatures.
• So this going to be very complex task yet again. Good Luck for me.

Compatibility with PCs

• Platform Support: This project is strictly for x86-64 Windows only. aarch64 and other architectures are not supported.

• Windows OS Compatibility Notice (Sanctum / Alt Syscalls):

  [!WARNING] Windows 10 and Windows 11 23H2 are NOT compatible with Sanctum's kernel driver!
  Sanctum's Alt Syscalls and kernel monitor rely on internal Windows kernel structures and offsets (0x1d8, 0x7d0, 0x77, PspServiceDescriptorGroupTable) that are strictly hardcoded for Windows 11 24H2 (Build 26100+).
  Windows 10 (all builds) and Windows 11 23H2 / 22H2 (Build 22621/22631) lack these exact offsets and dispatch structures. Running Sanctum kernel components on these earlier OS builds will result in unsupported errors or kernel crashes. Windows 11 24H2 is strictly required.

• This installer is designed to be used on clean or freshly formatted Windows PCs.

• For best results, install HydraDragon Antivirus only on systems where the required third-party components have not already been installed manually.

Important Notice

Please do not run this installer if any of the following programs are already installed on your PC:

• Python 3.12
• Node.js
• Npcap
• ClamAV
• Suricata
• OpenEDR or related EDR components

Installing HydraDragon Antivirus on a system where these components are already installed may cause version conflicts, path issues, service conflicts, or unexpected installer behavior.

Recommended Usage

Use this installer on:

• Fresh Windows installations
• Clean test machines
• Virtual machines
• PCs without existing antivirus engine dependencies

If you already have any of the required components installed, uninstall them first or use a clean Windows environment before installing HydraDragon Antivirus.

Important Notes & Limitations

Project Scope

HydraDragon is a local antivirus (except Xcitium cloud) project currently under active and experimental development.

• It operates locally on the system.
• It is intended for research, learning, and malware analysis experimentation.

This project does not aim to replace your primary daily antivirus solution.

---

Detection Philosophy

• False positives may occur.
• The system assumes the machine is in a clean state (not post-infection).
• The project prioritizes deeper analysis over speed.
• The goal is long-term detection improvement rather than quick but shallow detection.
• This does NOT mean the project achieves a 99% detection rate — it reflects the development philosophy only.
• This antivirus not only uses his best signatures but almost every new signatures. That's why it's heavy.
• UPDATE: Detection philosophy is highly changed we prefer 90% instant detection instead of 99% very slow detection

---

Experimental Status