crazyevent / awesome-windows-kernel-security-development

awesome-windows-kernel-security-development

Windows Kernel Driver with C++ runtime

• https://github.com/sysprogs/BazisLib
• https://github.com/AmrThabet/winSRDF
• https://github.com/sidyhe/dxx
• https://github.com/zer0mem/libc
• https://github.com/eladraz/XDK
• https://github.com/vic4key/Cat-Driver
• https://github.com/AndrewGaspar/km-stl
• https://github.com/zer0mem/KernelProject
• https://github.com/zer0mem/miniCommon
• https://github.com/jackqk/mystudy

DKOM

• https://github.com/nbqofficial/HideDriver
• https://github.com/landhb/HideProcess
• https://github.com/tfairane/DKOM

SSDT HOOK

• https://github.com/papadp/shd
• https://github.com/bronzeMe/SSDT_Hook_x64
• https://github.com/s18leoare/Hackshield-Driver-Bypass
• https://github.com/sincoder/hidedir
• https://github.com/wyrover/HKkernelDbg
• https://github.com/CherryZY/Process_Protect_Module
• https://github.com/weixu8/RegistryMonitor
• https://github.com/nmgwddj/Learn-Windows-Drivers

EAT/IAT/OBJECT/IRP/IDT HOOK

• https://github.com/HollyDi/Ring0Hook
• https://github.com/mgeeky/prc_xchk
• https://github.com/tinysec/iathook

INLINE HOOK

• https://github.com/MalwareTech/FstHook
• https://github.com/Menooker/FishHook

Inject Technique

• https://github.com/tinysec/runwithdll
• https://github.com/NtOpcode/NT-APC-Injector
• https://github.com/caidongyun/WinCodeInjection
• https://github.com/countercept/doublepulsar-usermode-injector
• https://github.com/mq1n/DLLThreadInjectionDetector
• https://github.com/hkhk366/Memory_Codes_Injection
• https://github.com/chango77747/ShellCodeInjector_MsBuild
• https://github.com/Zer0Mem0ry/ManualMap
• https://github.com/secrary/InfectPE
• https://github.com/zodiacon/DllInjectionWithThreadContext
• https://github.com/NtOpcode/RtlCreateUserThread-DLL-Injection
• https://github.com/hasherezade/chimera_loader
• https://github.com/Ciantic/RemoteThreader
• https://github.com/OlSut/Kinject-x64
• https://github.com/tandasat/RemoteWriteMonitor
• https://github.com/stormshield/Beholder-Win32
• https://github.com/secrary/InjectProc
• https://github.com/AzureGreen/InjectCollection
• https://github.com/uItra/Injectora
• https://github.com/rootm0s/Injectors
• https://github.com/Spajed/processrefund

Memoryload Dll

• https://github.com/fancycode/MemoryModule

Memoryload Driver

• https://github.com/Professor-plum/Reflective-Driver-Loader

HOOK Engine

• https://github.com/Ilyatk/HookEngine
• https://github.com/zyantific/zyan-hook-engine
• https://github.com/martona/mhook
• https://github.com/EasyHook/EasyHook
• https://github.com/RelicOfTesla/Detours

CallBack

• https://github.com/JKornev/hidden
• https://github.com/binbibi/CallbackEx

Minifilter

• https://github.com/idkwim/mfd
• https://github.com/Coxious/Antinvader
• https://github.com/tandasat/Scavenger
• https://github.com/fishfly/X70FSD
• https://github.com/aleksk/LazyCopy
• https://github.com/KhaiTB/BKAV.Filter

TDI

• https://github.com/michael4338/TDI
• https://github.com/cullengao/tdi_monitor
• https://github.com/uniking/TDI-Demo
• https://github.com/codereba/netmon

WFP

• https://github.com/basil00/Divert
• https://github.com/WPO-Foundation/win-shaper
• https://github.com/raymon-tian/WFPFirewall
• https://github.com/killbug2004/HashFilter
• https://github.com/henrypp/simplewall

NDIS

• https://github.com/michael4338/NDIS
• https://github.com/IAmAnubhavSaini/ndislwf
• https://github.com/OpenVPN/tap-windows6
• https://github.com/SageAxcess/pcap-ndis6
• https://github.com/uniking/NDIS-Demo
• https://github.com/mkdym/NDISDriverInst
• https://github.com/debugfan/packetprot
• https://github.com/Iamgublin/NDIS6.30-NetMonitor
• https://github.com/nmap/npcap
• https://github.com/Ltangjian/FireWall

WSK

• https://github.com/reinhardvz/wsk
• https://github.com/akayn/kbMon
• https://github.com/02strich/audionet
• https://github.com/mestefy/securityplus
• https://github.com/skycipher/CNGProvider

ROOTKITS

• https://github.com/hfiref0x/ZeroAccess
• https://github.com/hackedteam/driver-win32
• https://github.com/hackedteam/driver-win64
• https://github.com/csurage/Rootkit
• https://github.com/bowlofstew/rootkit.com
• https://github.com/Nervous/GreenKit-Rootkit
• https://github.com/bytecode-77/r77-rootkit
• https://github.com/Cr4sh/WindowsRegistryRootkit
• https://github.com/Alifcccccc/Windows-Rootkits
• https://github.com/Schnocker/NoEye
• https://github.com/christian-roggia/open-myrtus
• https://github.com/Cr4sh/DrvHide-PoC
• https://github.com/mstefanowich/SquiddlyDiddly2
• https://github.com/MalwareTech/FakeMBR
• https://github.com/Cr4sh/PTBypass-PoC
• https://github.com/psaneme/Kung-Fu-Malware
• https://github.com/m0n0ph1/Process-Hollowing
• https://github.com/hasherezade/persistence_demos
• https://github.com/MinhasKamal/TrojanCockroach
• https://github.com/akayn/kbMon

BOOTKITS

• https://github.com/DeviceObject/rk2017
• https://github.com/DeviceObject/ChangeDiskSector
• https://github.com/DeviceObject/Uefi_HelloWorld
• https://github.com/DeviceObject/ShitDrv
• https://github.com/DeviceObject/DarkCloud
• https://github.com/nyx0/Rovnix
• https://github.com/MalwareTech/TinyXPB
• https://github.com/m0n0ph1/Win64-Rovnix-VBR-Bootkit
• https://github.com/NextSecurity/Gozi-MBR-rootkit
• https://github.com/NextSecurity/vector-edk
• https://github.com/ahixon/booty

UEFI/SMM

• https://github.com/DeviceObject/Uefi_HelloWorld
• https://github.com/LongSoft/UEFITool
• https://github.com/dude719/UEFI-Bootkit
• https://github.com/quarkslab/dreamboot
• https://github.com/gyje/BIOS_Rootkit
• https://github.com/scumjr/the-sea-watcher
• https://github.com/zhuyue1314/stoned-UEFI-bootkit
• https://github.com/hackedteam/vector-edk
• https://github.com/Cr4sh/SmmBackdoor
• https://github.com/Cr4sh/PeiBackdoor
• https://github.com/Cr4sh/fwexpl

Anti Debug

• https://github.com/LordNoteworthy/al-khaser
• https://github.com/eschweiler/ProReversing

Malware

• https://github.com/bxlcity/malware
• https://github.com/grcasanova/SuperVirus
• https://github.com/hackedteam/core-win32
• https://github.com/hackedteam/scout-win
• https://github.com/hackedteam/vector-dropper

Malware analysis

• https://github.com/bloomer1016

ArkTools

• https://github.com/AzureGreen/ArkProtect
• https://github.com/AzureGreen/ArkToolDrv
• https://github.com/HollyDi/PCAssistant
• https://github.com/ChengChengCC/Ark-tools
• https://github.com/swatkat/arkitlib
• https://github.com/swwwolf/wdbgark
• https://github.com/zibility/Anti-Rootkits
• https://github.com/SLAUC91/AntiCheat
• https://github.com/sincoder/A-Protect
• https://github.com/apriorit/antirootkit-anti-splicer
• https://github.com/kedebug/ScDetective
• https://github.com/PKRoma/ProcessHacker

Bypass PatchPuard

• https://github.com/hfiref0x/UPGDSED
• https://github.com/tandasat/PgResarch
• https://github.com/killvxk/DisableWin10PatchguardPoc
• https://github.com/tandasat/findpg
• https://github.com/zer0mem/HowToBoostPatchGuard

Bypass DSE

• https://github.com/hfiref0x/TDL
• https://github.com/hfiref0x/DSEFix

Windows Kernel Exploits

• https://github.com/tinysec/vulnerability
• https://github.com/akayn/demos
• https://github.com/abatchy17/WindowsExploits
• https://github.com/recodeking/WindowsExploitation
• https://github.com/GDSSecurity/Windows-Exploit-Suggester
• https://github.com/rwfpl/rewolf-pcausa-exploit
• https://github.com/ratty3697/HackSpy-Trojan-Exploit
• https://github.com/SecWiki/windows-kernel-exploits
• https://github.com/sensepost/ms16-098
• https://github.com/shjalayeri/sysret
• https://github.com/sam-b/windows_kernel_resources
• https://github.com/sensepost/gdi-palettes-exp
• https://github.com/ExpLife/ByPassCfg
• https://github.com/Rootkitsmm/WinIo-Vidix
• https://github.com/andrewkabai/vulnwindrv
• https://github.com/mwrlabs/CVE-2016-7255
• https://github.com/hacksysteam/HackSysExtremeVulnerableDriver
• https://github.com/MarkHC/HandleMaster
• https://github.com/SamLarenN/CapcomDKOM
• https://github.com/zerosum0x0/puppetstrings
• https://github.com/zerosum0x0/ShellcodeDriver
• https://github.com/Rootkitsmm/WinIo-Vidix
• https://github.com/progmboy/kernel_vul_poc
• https://github.com/rwfpl/rewolf-msi-exploit
• https://github.com/rwfpl/rewolf-pcausa-exploit
• https://github.com/Rootkitsmm/Win10Pcap-Exploit
• https://github.com/Rootkitsmm/MS15-061
• https://github.com/Rootkitsmm/cve-2016-0040
• https://github.com/Rootkitsmm/CVEXX-XX
• https://github.com/sensepost/ms16-098
• https://github.com/Trietptm-on-Security/bug-free-adventure
• https://github.com/sam-b/CVE-2014-4113
• https://github.com/Rootkitsmm/OpenVpn-Pool-Overflow
• https://github.com/Rootkitsmm/UnThreatAVDriver-DOS
• https://github.com/Cr4sh/ThinkPwn
• https://github.com/hfiref0x/CVE-2015-1701

SandboxEscape

• https://github.com/SilverMoonSecurity/SandboxEvasion
• https://github.com/exAphex/SandboxEscape
• https://github.com/Fel0ny/Sandbox-Detection
• https://github.com/CheckPointSW/InviZzzible
• https://github.com/MalwareTech/AppContainerSandbox
• https://github.com/tyranid/IE11SandboxEscapes
• https://github.com/649/Chrome-Sandbox-Exploit
• https://github.com/google/sandbox-attacksurface-analysis-tools
• https://github.com/conix-security/zer0m0n
• https://github.com/iceb0y/windows-container
• https://github.com/s7ephen/SandKit
• https://github.com/D4Vinci/Dr0p1t-Framework
• https://github.com/cryptolok/MorphAES
• https://github.com/mtalbi/vm_escape
• https://github.com/unamer/vmware_escape
• https://github.com/erezto/lua-sandbox-escape
• https://github.com/brownbelt/Edge-sandbox-escape
• https://github.com/shakenetwork/vmware_escape
• https://github.com/Cr4sh/prl_guest_to_host

HIPS

• https://github.com/0xdabbad00/OpenHIPS
• https://github.com/ExpLife/Norton_AntiVirus_SourceCode
• https://github.com/majian55555/MJAntiVirusEngine
• https://github.com/develbranch/TinyAntivirus
• https://github.com/tandasat/EopMon
• https://github.com/tandasat/MemoryMon

VT

• https://github.com/ionescu007/SimpleVisor
• https://github.com/zer0mem/MiniHyperVisorProject
• https://github.com/zer0mem/ShowMeYourGongFu
• https://github.com/zer0mem/HyperVisor
• https://github.com/marche147/SimpleVT
• https://github.com/DarthTon/HyperBone
• https://github.com/nick-kvmhv/splittlb
• https://github.com/zareprj/Vmx_Prj
• https://github.com/ZhuHuiBeiShaDiao/MiniVTx64
• https://github.com/tandasat/HyperPlatform
• https://github.com/hzqst/Syscall-Monitor
• https://github.com/asamy/ksm
• https://github.com/in12hacker/VT_64_EPT
• https://github.com/ZhuHuiBeiShaDiao/PFHook
• https://github.com/tandasat/FU_Hypervisor
• https://github.com/tandasat/DdiMon
• https://github.com/tandasat/GuardMon
• https://github.com/yqsy/VT_demo
• https://github.com/OkazakiNagisa/VTbasedDebuggerWin7
• https://github.com/Ouroboros/JuusanKoubou
• https://github.com/aaa1616/Hypervisor
• https://github.com/Nukem9/VirtualDbg
• https://github.com/Nukem9/VirtualDbgHide
• https://github.com/cheat-engine/cheat-engine

Fuzzer

• https://github.com/Cr4sh/ioctlfuzzer
• https://github.com/Cr4sh/MsFontsFuzz
• https://github.com/hfiref0x/NtCall64
• https://github.com/Rootkitsmm/Win32k-Fuzzer
• https://github.com/mwrlabs/KernelFuzzer
• https://github.com/SignalSEC/kirlangic-ttf-fuzzer

Miscellaneous

• https://github.com/ExpLife/ByPassCfg
• https://github.com/hfiref0x/SXSEXP
• https://github.com/hfiref0x/VBoxHardenedLoader
• https://github.com/hfiref0x/SyscallTables
• https://github.com/hfiref0x/WinObjEx64
• https://github.com/Cr4sh/DbgCb
• https://github.com/Cr4sh/s6_pcie_microblaze
• https://github.com/ionescu007/SpecuCheck
• https://github.com/ionescu007/lxss
• https://github.com/intel/haxm
• https://github.com/akayn/Resources
• https://github.com/DarthTon/SecureEraseWin
• https://github.com/DarthTon/Xenos
• https://github.com/hfiref0x/UACME
• https://github.com/DarthTon/Blackbone
• https://github.com/tinysec/windows-syscall-table
• https://github.com/tinysec/jsrt
• https://github.com/zodiacon/DriverMon
• https://github.com/zodiacon/GflagsX
• https://github.com/zodiacon/PEExplorer
• https://github.com/zodiacon/KernelExplorer
• https://github.com/zodiacon/AllTools
• https://github.com/zodiacon/WindowsInternals
• https://github.com/hackedteam/vector-silent
• https://github.com/hackedteam/core-packer
• https://github.com/hackedteam/vector-recover
• https://github.com/k33nteam/cc-shellcoding
• https://github.com/rwfpl/rewolf-wow64ext
• https://github.com/rwfpl/rewolf-x86-virtualizer
• https://github.com/rwfpl/rewolf-gogogadget
• https://github.com/rwfpl/rewolf-dllpackager
• https://github.com/Microsoft/ChakraCore
• https://github.com/google/symboliclink-testing-tools
• https://github.com/ptresearch/IntelME-JTAG
• https://github.com/smourier/TraceSpy