Dump-GUY / IDA_PHNT_TYPES
Converted phnt (Native API header files from the System Informer project) to IDA TIL, IDC (Hex-Rays).
☆131Updated 7 months ago
Alternatives and similar repositories for IDA_PHNT_TYPES:
Users that are interested in IDA_PHNT_TYPES are comparing it to the libraries listed below
- msdocsviewer is a simple tool that parses Microsoft's win32 API and driver documentation to be used within IDA.☆151Updated last year
- Resolve DOS MZ executable symbols at runtime☆96Updated 3 years ago
- IOCTLpus can be used to make DeviceIoControl requests with arbitrary inputs (with functionality somewhat similar to Burp Repeater).☆88Updated 3 years ago
- ☆82Updated 9 months ago
- Demystifying PatchGuard is a comprehensive analysis of Microsoft's security feature called PatchGuard, which is designed to prevent unaut…☆117Updated last year
- ☆142Updated last year
- Small tool to convert beteween the PE alignments (raw and virtual).☆87Updated 2 years ago
- ☆145Updated last year
- compile-time control flow obfuscation using mba☆181Updated last year
- Inlay hints for hex-rays☆55Updated 3 weeks ago
- Achieve arbitrary kernel read/writes/function calling in Hypervisor-Protected Code Integrity (HVCI) protected environments calling withou…☆193Updated 4 months ago
- ☆71Updated 3 weeks ago
- Single header version of System Informer's phnt library.☆203Updated this week
- A tool that is used to hunt vulnerabilities in x64 WDM drivers☆183Updated last month
- Abusing exceptions for code execution.☆109Updated 2 years ago
- Using Microsoft Warbird to automatically unpack and execute encrypted shellcode in ClipSp.sys without triggering PatchGuard☆244Updated 2 years ago
- A devirtualization engine for Themida.☆97Updated last year
- The Windbg extensions to study Hyper-V on Intel and AMD processors.☆152Updated 2 weeks ago
- Load dll with undocumented functions and debug symbols☆47Updated 8 months ago
- Finding Truth in the Shadows☆89Updated 2 years ago
- An x86-64 code virtualizer for VM based obfuscation☆109Updated 3 months ago
- Post exploitation technique to turn arbitrary kernel write / increment into full read/write primitive on Windows 11 22H2☆225Updated 2 years ago
- Windows PDB parser for kernel-mode environment.☆95Updated 2 years ago
- BYOVD: Loading dbk64.sys and grabbing a handle to it☆149Updated 2 years ago
- Report and exploit of CVE-2023-36427☆91Updated last year
- Integration of Microsoft Warbird with the MSVC compiler☆97Updated last year
- Hook all callbacks which are registered with LdrRegisterDllNotification☆85Updated 2 years ago