Alternatives and similar repositories for mini-filter-driver-framework

Users that are interested in mini-filter-driver-framework are comparing it to the libraries listed below

• DownWithUp / ALPC-Example
  An example of a client and server using Windows' ALPC functions to send and receive data.
  ☆115Updated 11 months ago
• zodiacon / PoolMonXv3
  Monitor Kernel pool allocations tags
  ☆75Updated 2 years ago
• hfiref0x / AuthHashCalc
  Authenticode Hash Calculator for PE32/PE32+ files
  ☆120Updated 6 months ago
• A-Normal-User / NtSocket_NtClient_NtServer
  Using NtCreateFile and NtDeviceIoControlFile to realize the function of winsock（利用NtCreateFile和NtDeviceIoControlFile 实现winsock的功能）
  ☆123Updated 3 years ago
• je5442804 / CreateProcessInternalW-Full
  Reimplement CreateProcessInternalW via Windows 10 20H1+/Windows 11 Base on NtCreateUserProcess-Post
  ☆76Updated last year
• TheAenema / hm-pe-packer
  A x64 PE Packer/Protector Developed in C++ and VisualStudio
  ☆54Updated 2 years ago
• zodiacon / ObjectExplorer
  Explore Kernel Objects on Windows
  ☆241Updated 9 months ago
• mihaly044 / pedigest
  Helper functions for calculating the authenticode digest for a portable executable file
  ☆21Updated 5 years ago
• bb107 / RtlWow64
  c++ implementation of windows heavens gate
  ☆70Updated 4 years ago
• zodiacon / DbgPrint
  Debug Print viewer (user and kernel)
  ☆70Updated last year
• sgabe / SymlinkProtect
  File system minifilter driver for Windows to block symbolic link attacks.
  ☆52Updated 5 years ago
• alal4465 / KernelMon
  A ProcMon-esque tool for monitoring Windows Kernel Drivers
  ☆60Updated 4 years ago
• m417z / LdrDllNotificationHook
  Hook all callbacks which are registered with LdrRegisterDllNotification
  ☆96Updated 9 months ago
• Fatmike-GH / PELoader
  A Windows PE loader / manual mapper for executables (x86 and x64) with full TLS (Thread Local Storage) support.
  ☆82Updated 2 months ago
• Rhydon1337 / windows-kernel-process-protector
  Protect a process from code injection, termination and hooking
  ☆49Updated 4 years ago
• magnusstubman / dll-exports
  Collection of DLL function export forwards for DLL export function proxying
  ☆107Updated 4 months ago
• diversenok / Suspending-Techniques
  Comparing, discussing, and bypassing various techniques for suspending and freezing processes on Windows.
  ☆131Updated 4 years ago
• utoni / PastDSE
  DSE bypass using a leaked cert and adjusting the current clock.
  ☆152Updated 3 months ago
• 0mWindyBug / MinifilterHook
  silence file system monitoring components by hooking their minifilters
  ☆58Updated last year
• zodiacon / TotalSystem
  View Windows System in action
  ☆44Updated 5 months ago
• zodiacon / sysrun
  Run any executable as SYSTEM account (no service required)
  ☆138Updated last year
• Rhydon1337 / windows-kernel-file-delete
  Force a file delete using a windows kernel driver
  ☆72Updated 3 years ago
• SweetIceLolly / Prevent_File_Deletion
  Record & prevent file deletion in kernel mode
  ☆46Updated 5 years ago
• zodiacon / winnativeapibooksamples
  Samples from my book Windows Native API programming
  ☆80Updated 8 months ago
• zodiacon / PoolMonXv2
  Kernel Pool Monitor
  ☆127Updated 3 years ago
• zodiacon / WinSys
  C++ library for low-level Windows development
  ☆81Updated last year
• GoodstudyChina / APC-injection-x86-x64
  ☆74Updated 7 years ago
• gmh5225 / ntoskrnl_file_collection
  Collect various versions of ntoskrnl files
  ☆59Updated 2 years ago
• 0mWindyBug / WFPCalloutReserach
  research revolving the windows filtering platform callout mechanism
  ☆35Updated last year
• zodiacon / TotalPE2
  PE Viewer
  ☆206Updated 4 months ago