sventek-s

Detours

Detours is a software package for monitoring and instrumenting API calls on Windows. It is distributed in source code form.

SourceSync

Set of plugins and library for dynamic pdb generation and synchronisation

oleviewdotnet

A .net OLE/COM viewer and inspector to merge functionality of OleView and Test Container

bap

Binary Analysis Platform

windows-syscalls

Windows System Call Tables (NT/2000/XP/2003/Vista/7/8/10/11)

PESD-Exporter-Extension

PESD (Proxy Enriched Sequence Diagrams) Exporter converts Burp Suite's proxy traffic into interactive diagrams

WinObjEx64

Windows Object Explorer 64-bit

WindowsInternals

Contains all the applications developed for the Second part of the 7th Edition of Windows Internals book

dnSpy

Unofficial revival of the well known .NET debugger and assembly editor, dnSpy

ILSpy

.NET Decompiler with support for PDB generation, ReadyToRun, Metadata (&more) - cross-platform!

WinDbg_Scripts

Useful scripts for WinDbg using the debugger data model

cet-research

A collection of tools, source code, and papers researching Windows' implementation of CET.

IoRingReadWritePrimitive

Post exploitation technique to turn arbitrary kernel write / increment into full read/write primitive on Windows 11 22H2

EagleVM

Native code virtualizer for x64 binaries

Sark

IDAPython Made Easy

pySymProxy

An implementation of a Microsoft Symbol Proxy server using Python

ida-minsc

A plugin based on IDAPython for a functional DWIM interface. Current development against most recent IDA is in the "persistence-refactor" branch, ancient (but stable) work is in "master", so... create an issue if you want/need something backported. Use "Wiki" or "Discussions" for examples, and smash that "Star" button if you like this.

BasicWXAMFuzzer

jswd

javascript extension of windbg for hacker.

cfexplode

Automatically exported from code.google.com/p/cfexplode

QuickAsm

Simple x86/x64 Assembler/Disassembler/Emulator

Proxy-DLL-Loads

A proof of concept demonstrating the DLL-load proxying using undocumented Syscalls.

llil_transpiler

transpile llil to c++ for execution and testing

A-Walk-Through-x86

Best way to learn x86 is by hacking it

raddebugger

A native, user-mode, multi-process, graphical debugger.

rp-bf.rs

rp-bf: A library to bruteforce ROP gadgets by emulating a Windows user-mode crash-dump

rex

Shellphish's automated exploitation engine, originally created for the Cyber Grand Challenge.

ArbitraryDirectoryDeletion

From directory deletion to SYSTEM shell

defcon_27_windbg_workshop

DEFCON 27 workshop - Modern Debugging with WinDbg Preview

Win-Debloat-Tools

Re-imagining Windows like a minimal OS install, already debloated with minimal impact for most functionality.