0xeb / WinTools
A collection of free miscellaneous Windows tools
☆128Updated 4 months ago
Alternatives and similar repositories for WinTools:
Users that are interested in WinTools are comparing it to the libraries listed below
- Events from all manifest-based and mof-based ETW providers across Windows 10 versions☆279Updated 8 months ago
- Document ETW providers☆216Updated 4 years ago
- ☆61Updated 11 months ago
- Named pipe I/O ETW provider for Windows☆69Updated 4 years ago
- View ETW Provider manifest☆447Updated 2 months ago
- API Set Viewer☆84Updated 5 years ago
- Run Processes as PPL with ELAM☆154Updated 2 years ago
- Sysmon-Like research tool for ETW☆349Updated 2 years ago
- Lnk file parser☆79Updated last week
- CallMon is an experimental system call monitoring tool that works on Windows 10 versions 2004+ using PsAltSystemCallHandlers☆129Updated 4 years ago
- Analysis and manipulation of extended attribute ($EA) on NTFS☆38Updated 9 years ago
- A WinDbg extension to trace COM interactions☆110Updated 11 months ago
- A command tree based on commands and extensions for Windows Kernel Debugging.☆106Updated 4 years ago
- Trace events in real time sessions☆44Updated last year
- Leverage AMSI (Antimalware Scan Interface) technology to aid your analysis. This tool saves all buffers (scripts, .NET assemblies, etc) …☆92Updated 3 years ago
- DotNext 2019 St. Petersburg Talk Demos☆37Updated 5 years ago
- This tool is the result of a reverse engineering process of the Windows service called SysMain. Time to interact with the prefetch files …☆30Updated 4 years ago
- Library and tools to access the Windows Prefetch File (SCCA) format.☆72Updated 3 weeks ago
- Enhanced version of the classic Spy++ tool☆179Updated 9 months ago
- PE Viewer☆161Updated 2 months ago
- Windows Drivers☆97Updated 5 years ago
- Run any executable as SYSTEM account (no service required)☆125Updated 8 months ago
- ☆68Updated 2 years ago
- PoC memory injection detection agent based on ETW, for offensive and defensive research purposes☆259Updated 3 years ago
- Authenticode Hash Calculator for PE32/PE32+ files☆108Updated 10 months ago
- Windows Registry Knowledge Base☆169Updated 3 months ago
- Simple project that demonstrates how an ETW consumer can be created just by using NTDLL☆139Updated 5 years ago
- C# Utilities for Windows Notification Facility☆126Updated last month
- A PowerShell module to assist in parsing and managing catalog files.☆22Updated 8 years ago
- Combining Sealighter with unpatched exploits to run the Threat-Intelligence ETW Provider☆168Updated 2 years ago