DownWithUp

no-defender

A slightly more fun way to disable windows defender + firewall. (through the WSC api)

windows-drivers-rs

Platform that enables Windows driver development in Rust. Developed by Surface.

EDRSandblast

memflow

physical memory introspection framework

obfus.h

Macro-header for compile-time C obfuscation (tcc, win x86/x64)

yara-x

A rewrite of YARA in Rust.

obfuscator

PE bin2bin obfuscator

WProtect

UEFI-Bootkit

A small bootkit which does not rely on x64 assembly.

process-cloning

The Definitive Guide To Process Cloning on Windows

hoodie

Hoodie is a plugin for Godot Engine 4 that offers a visual scripting interface for generating procedural geometry.

tsffs

A snapshotting, coverage-guided fuzzer for software (UEFI, Kernel, firmware, BIOS) built on SIMICS

illusion-rs

Rusty Hypervisor - Windows UEFI Blue Pill Type-1 Hypervisor in Rust (Codename: Illusion)

UEFI-Lessons

Lessons to get to know UEFI programming in Linux with the help of EDKII

CVE-2024-21111

Oracle VirtualBox Elevation of Privilege (Local Privilege Escalation) Vulnerability

DefenderYara

Extracted Yara rules from Windows Defender mpavbase and mpasbase

ZeroHVCI

Achieve arbitrary kernel read/writes/function calling in Hypervisor-Protected Code Integrity (HVCI) protected environments calling without admin permissions or kernel drivers.

SandboxSecurityTools

Security testing tools for Windows sandboxing technologies

PwnedBoot

Using Windows' own bootloader as a shim to bypass Secure Boot

SmmExploit

The report and the exploit of CVE-2021-26943, the kernel-to-SMM local privilege escalation vulnerability in ASUS UX360CA BIOS version 303.

RTCore64_Vulnerability

Use RTCore64 to map your driver on windows 11.

igvm

BadRentdrv2

A vulnerable driver exploited by me (BYOVD) that is capable of terminating several EDRs and antivirus software in the market, rendering them ineffective, working for both x32 and x64(CVE-2023-44976).

libiht

Intel Hardware Trace Library

UefiVarTool

Scriptable tool to read and write UEFI variables from EFI shell. View, save, edit and restore hidden UEFI (BIOS) Setup settings faster than with the OEM menu forms.

phnt-rs

Rust bindings to the System Informer's (formerly known as Process Hacker) "phnt" native Windows headers

thunderclap-fpga-arria10

Thunderclap hardware for Intel Arria 10 FPGA

libalpc

InactiveTitlebarPatch

Simple registry patch to turn inactive title bar color dark

Glassboxie