xrv3ovl's starred repositories
RpcProxyInvoke
Simple POC library to execute arbitrary calls proxying them via NdrServerCall2 or similar
API-To-ETW
Uses ghidra to find all ETW write metadata for each API in a PE file
IDA-Pro-SigMaker
Signature maker plugin for IDA 8.x
CodeLabyrinth
LLVM Obfuscation Pass
PeaceMaker
PeaceMaker Threat Detection is a Windows kernel-based application that detects advanced techniques used by malware.
clang-languageservice
A language service built atop Clang
DynamicWrapperEx
x64 Registration-Free In-Process COM Automation Server.
KernelInjector
PoC kernel to usermode injection
PatchaPalooza
A comprehensive tool that provides an insightful analysis of Microsoft's monthly security updates.
superfetch
Translate virtual addresses to physical addresses from usermode.
ClearDriverTraces
clearing traces of a loaded driver
KDP-compatible-driver-loader
KDP compatible unsigned driver loader leveraging a write primitive in one of the IOCTLs of gdrv.sys
ThreadlessStompingKann
Combining 3 techniques (Threadless Injection + DLL Stomping + Caro-Kann) together to evade MDE.