0mWindyBug

unicorn

Unicorn CPU emulator framework (ARM, AArch64, M68K, Mips, Sparc, PowerPC, RiscV, S390x, TriCore, X86)

Windows-driver-samples

This repo contains driver samples prepared for use with Microsoft Visual Studio and the Windows Driver Kit (WDK). It contains both Universal Windows Driver and desktop-only driver samples.

pocs

Proof of Concepts (PE, PDF...)

RpcView

RpcView is a free tool to explore and decompile Microsoft RPC interfaces

WDExtract

Extract Windows Defender database from vdm files and unpack it

SinMapper

usermode driver mapper that forcefully loads any signed kernel driver (legit cert) with a big enough section (example: .data, .rdata) to map your driver over. the main focus of this project is to prevent modern anti-cheats (BattlEye, EAC) from finding your driver and having the power to hook anything due to being inside of legit memory (signed legit driver).

RPCMon

RPC Monitor tool based on Event Tracing for Windows

warbird-hook

Using Microsoft Warbird to automatically unpack and execute encrypted shellcode in ClipSp.sys without triggering PatchGuard

GhostMapper

winio

A fork of WinIo which developed by Yariv Kaplan from http://www.internals.com

GhostMapperUM

manual map unsigned driver over signed memory

ntdoc

Native API online documentation, based on the System Informer (formerly Process Hacker) phnt headers

classinformer-ida8

IDA Class Informer plugin for IDA 8.x

CiDllDemo

Use ci.dll API for validating Authenticode signature of files

Suspending-Techniques

Comparing, discussing, and bypassing various techniques for suspending and freezing processes on Windows.

24h2-nt-exploit

Exploit targeting NT kernel in 24H2 Windows Insider Preview

windows-software-policy

Research on obfuscated licensing APIs / CLIP service in the Windows kernel

KernelInjector

PoC kernel to usermode injection

RansomGuard

anti-ransomware file-system filter

DumpDriver

DataptrHooks

ntoskrnl .data hooks for UM-KM communication

vmware-svga

not mine, clone from

WinMain-is-usually-a-function

Windows NT port of 'Main is usually a function. So then when is it not?'

EtwKeyboardDetection

WFPCalloutReserach

research revolving the windows filtering platform callout mechanism

KeystrokeSniffer

a windows kernel keylogger that works

InstrumentationCallbacks

A native Windows library for intercepting kernel-to-user transitions using instrumentation callbacks

PnpNotifyResearch

a driver to enumerate registered pnp callbacks for a particular interface class based on reversal of IoRegisterPlugPlayNotification

wdnis_tool

Palfrey