TempAccountNull

emudbg

A fast Windows emulator + debugger for reverse engineering. Runs any executable in debug mode, disassembles with Zydis, emulates instructions, and skips Windows API calls via debugger for maximum speed.

accelmem

C++ Cross-Platform SSE / AVX Intrinsic-Accelerated, Multi-threaded & Inlined Memory Operations, Hashing, and Encryption

BestEdrOfTheMarket

EDR Lab for Experimentation Purposes

binfold

Symbol porting

BlockEDRTraffic

Two tools written in C that block network traffic for blacklisted EDR processes, using either Windows Defender Firewall (WDF) or Windows Filtering Platform (WFP).

cmut

Basic C++20 Type Polymorphism && Type Translation

Curtain_rtti_dumper

Diskjacker

Runtime Hyper-V Hijacking with DDMA

DLLInjectionDetector

A DLL Injection Detector for Windows

DllShimmer

Weaponize DLL hijacking easily. Backdoor any function in any DLL.

GameMitigations

A simple PWSH script that disables Windows Security Mitigations for a given EXE.

goldberg_emulator

Goldberg emulator that actually compiles

Hells-Hollow

Hells Hollow Windows 11 Rootkit technique to Hook the SSDT via Alt Syscalls

hiddriver360

Xbox 360 HID controller driver

ida-pro-mcp

MCP Server for IDA Pro.

ida-sdk

This repository offers an open-source C++ SDK bindings for IDA, enabling custom plugin development and automation.

kurasagi_pg_bypass

Windows 11 24H2 Runtime PatchGuard Bypass

labs-releases

Elastic Security Labs releases

Nuklear-Dx12

Nuklear Dx12 Secure Render

Obfusk8

Obfusk8: lightweight Obfuscation library based on C++17 / Header Only for windows binaries

OpenLumina

IDA plugin that allows connecting to third party Lumina servers

Page-Table-Injector

Windows x64 DLL/Driver manual map injection on a non-present PML4E using physical memory read/writes, direct page table manipulation and contextualized address space cloning

pe-packer_adv

X86 Packer with Portable Executable compatibility.

ROP_ROCKET

ROP ROCKET is an advanced code-reuse attack framework, with extensive ROP chain generation capabilities, including for novel Windows Syscalls attack, a novel Heaven's Gate, and "shellcodeless" ROP. The framework utilizes emulation and obfuscation to help expand the attack surface.

SignatureKid

SpotveeC_ipa

Compiled EeveeSpotify IPA's.

ultimate_spoofer

A stealthy anti-fingerprinting toolkit for Windows

unxorer

Yet another IDA Pro/Home plugin for deobfuscating stack strings

win11-kernel-execution-syscall-hijack

Executing Kernel Routines via Syscall Table Hijack (Kernel Code Execution)

YTLite_ipabuild

A flexible enhancer for YouTube on iOS