0xAlexei / WindowsDefenderTools
Tools for instrumenting Windows Defender's mpengine.dll
☆281Updated 6 years ago
Related projects ⓘ
Alternatives and complementary repositories for WindowsDefenderTools
- ☆229Updated 7 years ago
- Extract Windows Defender database from vdm files and unpack it☆425Updated 4 years ago
- Canadian Furious Beaver is a ProcMon-style tool designed only for capturing IRPs sent to any Windows driver.☆310Updated 7 months ago
- This is a simple example and explanation of obfuscating API resolution via hashing☆228Updated 4 years ago
- Local privilege escalation PoC exploit for CVE-2019-16098☆191Updated 5 years ago
- FLARE Kernel Shellcode Loader☆176Updated 5 years ago
- Windows Kernel Drivers fuzzer☆296Updated 7 years ago
- Hyper-V Research is trendy now☆172Updated 6 months ago
- Universal Unhooking☆316Updated 6 years ago
- ☆393Updated 7 years ago
- This respository is a collection of C# class libraries which implement RPC clients for various versions of the Windows Operating System f…☆269Updated 4 years ago
- Research on Windows Kernel Executive Callback Objects☆278Updated 4 years ago
- Recon 2015 Presentation from Alex Ionescu☆232Updated 8 years ago
- Examples of leaking Kernel Mode information from User Mode on Windows☆581Updated 7 years ago
- Quickly debug shellcode extracted during malware analysis☆565Updated last year
- Process Doppelgänging☆154Updated 6 years ago
- Driver Initial Reconnaissance Tool☆120Updated 4 years ago
- ☆107Updated 4 years ago
- Windows RPC Python fuzzer☆157Updated 7 years ago
- Two IDAPython Scripts help you to reconstruct Microsoft COM (Component Object Model) Code☆178Updated 4 years ago
- A tool to help when dealing with Windows IOCTL codes or reversing Windows drivers.☆422Updated 6 years ago
- Dump of win32k POCs for bugs I've found☆370Updated 2 years ago
- Demos of various (also non standard) persistence methods used by malware☆219Updated last year
- Some research on AltSystemCallHandlers functionality in Windows 10 20H1 18999☆206Updated 5 years ago
- awesome-windows-security-development☆170Updated 6 years ago
- An extensible framework for easily writing compiler optimized position independent x86 / x64 shellcode for windows platforms.☆494Updated 5 years ago
- PoC exploiting Aligned Chunk Confusion on Windows kernel Segment Heap☆195Updated 4 years ago
- Idapython script to carve binary for internal RPC structures☆214Updated 8 months ago
- ChimeraPE (a PE injector type - alternative to: RunPE, ReflectiveLoader, etc) - a template for manual loading of EXE, loading imports pay…☆216Updated last year
- An improvement of the original reflective DLL injection technique by Stephen Fewer of Harmony Security☆316Updated 7 years ago