Stingered
Well-known member
- Joined
- Jan 11, 2022
- Messages
- 135
- Reaction score
- 854
NoDelman v0.2 by Stingered (2026) - Driver Control Manager for NoDel.sys v0.3
NoDelman is a windows GUI tool designed to control, load, unload, and monitor the NoDel.sys kernel-level file system minifilter driver. It provides a graphical interface for managing the kernel-level deletion protection, permitting real-time toggling of driver enforcement without unhooking the filter stack.
Features:
Minifilter Management: Dynamically loads and unloads NoDel.sys using the Windows Service Control Manager (SCM) and FilterUnload.
Port Communication: Communicates via FilterConnectCommunicationPort and FilterSendMessage over \NoDelPort.
Dynamic Instance Setup: Auto-configures required minifilter registry keys Altitude 370000) on driver registration.
Privilege Elevation Checks: Enforces administrative requirements at launch and self-assigns SeLoadDriverPrivilege.
Real-time Health Monitoring: Polling timer automatically updates UI state metrics to detect if the underlying driver state changes.
Modern Common Controls: Pure C/C++ implementation using native Win32 API and ComCtl32 v6 visuals with zero external SDK overhead.
System Requirements:
Should work on any Windows OS 10+
*Running this in a VM is highly suggested to avert possible BSODs even though I haven't had a single intance
in testing.
Usage:
1. Place NoDel.sys in the same folder as NoDelman.exe.
2. Right-click NoDelman.exe and select Run as Administrator (REQUIRED!).
3. Load Driver: Stages NoDel.sys into C:\Windows\System32\drivers\, registers the service, sets up the instance altitude, and starts the service.
4. Pause / Resume Protection: Sends real-time control codes across \NoDelPort to pause or enable active file deletion filtering without unloading the driver from memory.
5. Unload Driver: Closes communication and removes ports and unloads the filter driver stack cleanly.
Notes:
NoDel.sys generates a denied_log.txt file located in folder '\Windows\Temp\'. If for some reason the file cannot
be written to that location it will fallback to root folder. See below for example output:
[BLOCKED] Target: \Device\HarddiskVolume1\Windows\System32\temp_update.tmp
Included is a testing tool called 'Deltst.exe' to verify the driver is working. This POC GUI tool will create a
DELETEME.TMP file on-load. The .TMP file should not be able to be deleted if the NoDel driver is loaded and enabled.
However, you can test with Notepad or any application - even Recyle Bin to test the driver functionality.
Why create this tool? There was a tricky self-deleting installer that I wanted to circumvent. It does.
I hope others find this tool useful, and a Special thanks to DarongMa for his help!
Stingered (2026)
NoDelman is a windows GUI tool designed to control, load, unload, and monitor the NoDel.sys kernel-level file system minifilter driver. It provides a graphical interface for managing the kernel-level deletion protection, permitting real-time toggling of driver enforcement without unhooking the filter stack.
Features:
Minifilter Management: Dynamically loads and unloads NoDel.sys using the Windows Service Control Manager (SCM) and FilterUnload.
Port Communication: Communicates via FilterConnectCommunicationPort and FilterSendMessage over \NoDelPort.
Dynamic Instance Setup: Auto-configures required minifilter registry keys Altitude 370000) on driver registration.
Privilege Elevation Checks: Enforces administrative requirements at launch and self-assigns SeLoadDriverPrivilege.
Real-time Health Monitoring: Polling timer automatically updates UI state metrics to detect if the underlying driver state changes.
Modern Common Controls: Pure C/C++ implementation using native Win32 API and ComCtl32 v6 visuals with zero external SDK overhead.
System Requirements:
Should work on any Windows OS 10+
*Running this in a VM is highly suggested to avert possible BSODs even though I haven't had a single intance
in testing.
Usage:
1. Place NoDel.sys in the same folder as NoDelman.exe.
2. Right-click NoDelman.exe and select Run as Administrator (REQUIRED!).
3. Load Driver: Stages NoDel.sys into C:\Windows\System32\drivers\, registers the service, sets up the instance altitude, and starts the service.
4. Pause / Resume Protection: Sends real-time control codes across \NoDelPort to pause or enable active file deletion filtering without unloading the driver from memory.
5. Unload Driver: Closes communication and removes ports and unloads the filter driver stack cleanly.
Notes:
NoDel.sys generates a denied_log.txt file located in folder '\Windows\Temp\'. If for some reason the file cannot
be written to that location it will fallback to root folder. See below for example output:
[BLOCKED] Target: \Device\HarddiskVolume1\Windows\System32\temp_update.tmp
Included is a testing tool called 'Deltst.exe' to verify the driver is working. This POC GUI tool will create a
DELETEME.TMP file on-load. The .TMP file should not be able to be deleted if the NoDel driver is loaded and enabled.
However, you can test with Notepad or any application - even Recyle Bin to test the driver functionality.
Why create this tool? There was a tricky self-deleting installer that I wanted to circumvent. It does.
I hope others find this tool useful, and a Special thanks to DarongMa for his help!
Stingered (2026)