Deputation

hygieia

Hygieia, a vulnerable driver traces scanner written in C++ as an x64 Windows kernel driver.

instrumentation_callbacks

A proof of concept demonstrating instrumentation callbacks on Windows 10 21h1 with a TLS variable to ensure all syscalls are caught.

pagewalkr

An x64 page table iterator written in C++ as a kernel mode windows driver.

kernel_sockets_memory

Kernel-based memory hacking framework communicating with a kernel driver via sockets.

kernel_payload_comms

A proof of concept demonstrating communication via mapped shared memory structures between a user-mode process and a kernel-mode payload on Windows 10 20H2.

syscall_extractor

A C++ syscall ID extractor for Windows. Developed, debugged and tested on 20H2.

poc_close_handle

CloseHandle hooking proof of concept in C++.

cpp_async_file_hashing

Asynchronous MD5 file hashing in C++ using futures.

blackout

fast-string

Convert strings to little endian hexadecimal representation for fast, compiler-friendly comparisons.

GreyM

Me fockin' pe protector

wdmcpp

Visual Studio Project example for using Microsoft's STL in WDM (Windows Kernel-mode Driver)

donations

dive

A tool for exploring each layer in a docker image

js2php

Converting Javascript .json files to PHP associative arrays.

limba

compile-time control flow obfuscation using mba

llm.c

LLM training in simple, raw C/CUDA

robotSpace

wdbgark

WinDBG Anti-RootKit Extension