L1B0 - Giters

DECAF (short for Dynamic Executable Code Analysis Framework) is a binary analysis platform based on QEMU. This is also the home of the DroidScope dynamic Android malware analysis platform. DroidScope is now an extension to DECAF.

Language:CGPL-3.0802 61 51

DSEFix

Windows x64 Driver Signature Enforcement Overrider

Language:CBSD-2-Clause711 44 13

NtRays

Hex-Rays microcode plugin for automated simplification of Windows Kernel decompilation.

Language:C++BSD-3-Clause533 16 4

Malware-Sample-Sources

Malware Sample Sources

500 150

CVE-2020-15368

CVE-2020-15368, aka "How to exploit a vulnerable driver"

Language:C++MIT438 60

radare2-r2pipe

Access radare2 via pipe from any programming language!

Language:JavaScript379 18 81

origami

Origami is a pure Ruby library to parse, modify and generate PDF documents.

Language:RubyLGPL-3.0324 17 66

gdrv-loader

Kernel driver loader using vulnerable gigabyte driver (https://www.secureauth.com/labs/advisories/gigabyte-drivers-elevation-privilege-vulnerabilities) to load a unsigned driver

Language:C216 20

Ty2yAntiVirus

一款真正的杀毒软件，扫描查杀、实时防护具备，VB+VC源码。

Language:Visual Basic 6.0GPL-3.0169 70

ioctlpus

Language:C#GPL-3.0107 70

spinlock

Different implementations of spinlock.

Language:C102 110

Windows-Exploits

Language:C++88 60

kmdf_re

Helper idapython code for reversing kmdf drivers

Language:C67 9 3

KMAC

Some usefull info when reverse engineering Kernel Mode Anti-Cheat

Language:C++67 30

VtToMe

之前学习X64VT写的代码，很多坑，但是大体的逻辑还是完整的。现发出来给更多想学VT的人参考...

Language:C++67 30

CVE-2022-25949

A years-old exploit of a local EoP vulnerability in Kingsoft Antivirus KWatch Driver version 2009.3.17.77.

Language:C++MIT36 5 1

loaders_modeling

Language:Python22 12 3

platpal

Language:C++12 18 3

copyexx

复制、剪切操作监控及扩展，生成任务列表，并可以暂停

Language:C++7 20

MimiDove

Tool for cleaning passwords from process memory

Language:C7 30

gdrv-loader

Kernel driver loader using vulnerable gigabyte driver (https://www.secureauth.com/labs/advisories/gigabyte-drivers-elevation-privilege-vulnerabilities) to load a unsigned driver

Language:C7 20

IOSpy

Filesystem minifilter driver spying on IO operations

Language:C7 20

E-DKOM

Evolutionary dkom attack - Linux && Windows

Language:C2 10