snowkoan

readdirectorychanges

Sample code that goes with "Understanding ReadDirectoryChangesW"

wtrace

Command line tracing tool for Windows, based on ETW.

icomake

Combine multiple ICO/PNGs into single .ICO file, retaining format of each sub-image, optimizing the order.

Kdrill

Python tool to check rootkits in Windows kernel

ETViewer

An alternative to Windows TraceView util

ImHex

🔍 A Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM.

sysinternals-source

Koppeling

Adaptive DLL hijacking / dynamic export forwarding

x509-cert-testcorpus

X.509 certificate test corpus that was scraped from public TLS servers

atomic-red-team

Small and highly portable detection tests based on MITRE's ATT&CK.

auxlib

Full reversing of the Microsoft Auxiliary Windows API Library and ported to C

ghidra-scripts

A collection of my Ghidra scripts to facilitate reverse engineering and vulnerability research.

ETW-Almulahaza

ETW-Almulahaza is a consumer python-based tool that help you monitor ETW events of the operating system

malware_training_vol1

Materials for Windows Malware Analysis training (volume 1)

awesome-executable-packing

A curated list of awesome resources related to executable packing

Backstab

A tool to kill antimalware protected processes

UmdhGui

Graphical user interface for the UMDH tool

PoolmonViz

Powershell script to view kernel memory pool information

WinObjEx64

Windows Object Explorer 64-bit

AutoHCK

AutoHCK is a tool for automating HCK/HLK testing, doing all the boilerplate steps in the process leaving you with simply choosing which driver you want to test on what os.

yara

The pattern matching swiss knife

yarGen

yarGen is a generator for YARA rules

windowskernelprogrammingbook

The Windows Kernel Programming book samples

pe-afl

docs

documentations, slides decks...

sysmon-modular

A repository of sysmon configuration modules

Windows-Containers

Welcome to our Windows Containers GitHub community! Ask questions, report bugs, and suggest features -- let's work together.

dotnet-computevirtualization

Sample class library for interfacing with Windows host compute service.

lsobj

Lists all visible objects in the Windows kernel object namespace, a command-line WinObj

ApplicationInspector

A source code analyzer built for surfacing features of interest and other characteristics to answer the question 'What's in the code?' quickly using static analysis with a json based rules engine. Ideal for scanning components before use or detecting feature level changes.