Advanced driver monitoring utility.
☆219Jul 13, 2022Updated 3 years ago
Alternatives and similar repositories for DrvMon
Users that are interested in DrvMon are comparing it to the libraries listed below
Sorting:
- Kernel Detective☆151Aug 12, 2022Updated 3 years ago
- C/C++ Runtime library for system file (Windows Kernel Driver) - Supports Microsoft STL☆192Aug 27, 2022Updated 3 years ago
- A DTrace on Windows Reimplementation☆372Feb 3, 2026Updated last month
- Analyze patches in a process☆260Jul 28, 2021Updated 4 years ago
- Easy Anti PatchGuard☆223Apr 9, 2021Updated 4 years ago
- Hex-Rays microcode plugin for automated simplification of Windows Kernel decompilation.☆657Jan 28, 2025Updated last year
- A library to develop kernel level Windows payloads for post HVCI era☆486May 18, 2021Updated 4 years ago
- ☆118Aug 7, 2022Updated 3 years ago
- Using Microsoft Warbird to automatically unpack and execute encrypted shellcode in ClipSp.sys without triggering PatchGuard☆269Aug 31, 2022Updated 3 years ago
- CallMon is an experimental system call monitoring tool that works on Windows 10 versions 2004+ using PsAltSystemCallHandlers☆145Sep 5, 2020Updated 5 years ago
- Taking advantage of CRT initialization, to get away with hooking protected applications☆48Nov 2, 2022Updated 3 years ago
- Load your driver like win32k.sys☆258Aug 20, 2022Updated 3 years ago
- Application Verifier Dynamic Fault Injection☆40Jan 12, 2026Updated last month
- Browse Page Tables on Windows (Page Table Viewer)☆234Apr 2, 2022Updated 3 years ago
- ☆153Jul 31, 2022Updated 3 years ago
- A bunch of parsers for PE and PDB formats in C++☆267May 15, 2024Updated last year
- Kernel DLL Injector using NX Bit Swapping and VAD hide for hiding injected DLL☆219Nov 12, 2020Updated 5 years ago
- Debugger Anti-Detection Benchmark☆383Updated this week
- Hide codes/data in the kernel address space.☆188May 8, 2021Updated 4 years ago
- HyperDeceit is the ultimate all-in-one library that emulates Hyper-V for Windows, giving you the ability to intercept and manipulate oper…☆379Jun 3, 2023Updated 2 years ago
- C++ STL in the Windows Kernel with C++ Exception Support☆434Aug 16, 2023Updated 2 years ago
- Analyze Windows x64 Kernel Memory Layout☆129Nov 19, 2020Updated 5 years ago
- Emulate Drivers in RING3 with self context mapping or unicorn☆365Aug 18, 2022Updated 3 years ago
- Post exploitation technique to turn arbitrary kernel write / increment into full read/write primitive on Windows 11 22H2☆249Jul 5, 2022Updated 3 years ago
- Hooking the GDT - Installing a Call Gate. POC for Rootkit Arsenal Book Second Edition (version 2022)☆73Aug 11, 2023Updated 2 years ago
- PoC capable of detecting manual syscalls from usermode.☆206Nov 13, 2025Updated 3 months ago
- A x64 Windows Rootkit using SSDT or Hypervisor hook☆564Jan 4, 2025Updated last year
- Hook system calls on Windows by using Kaspersky's hypervisor☆1,281Feb 14, 2026Updated 2 weeks ago
- Time Travel Debugging IDA plugin☆592Jun 27, 2024Updated last year
- Enumerate various traits from Windows processes as an aid to threat hunting☆202Jan 13, 2022Updated 4 years ago
- ☆59Jun 8, 2022Updated 3 years ago
- An application to view and filter pool allocations from a dmp file on Windows 10 RS5+.☆150Mar 2, 2023Updated 3 years ago
- x64 Windows kernel code execution via user-mode, arbitrary syscall, vulnerable IOCTLs demonstration☆388Jul 6, 2022Updated 3 years ago
- C++ Exceptions in Windows Drivers☆221Dec 21, 2020Updated 5 years ago
- Reverse engineered source code of the autochk rootkit☆210Nov 1, 2019Updated 6 years ago
- WTSRM☆216Aug 7, 2022Updated 3 years ago
- a simple intel vt code both support x86 & x64. PatchGuard monitor.☆77Oct 28, 2021Updated 4 years ago
- A small PoC that creates processes in Windows☆187Jun 6, 2024Updated last year
- Cross-platform tool that allows browsing and extracting C and C++ type declarations from PDB files.☆361Feb 9, 2025Updated last year