Alternatives and similar repositories for ntdll

Users that are interested in ntdll are comparing it to the libraries listed below

• h4xu3lyn / NTLib

  View on GitHub
  Headers for linking your software with ntdll.dll
  ☆15Nov 4, 2020Updated 5 years ago
• Fyyre / directntapi

  View on GitHub
  DirectNtApi - simple method to make ntapi function call without importing or walking export table. Work under Windows 7, 8 and 10
  ☆53Mar 12, 2024Updated last year
• Lima-X / Win32.Nebula

  View on GitHub
  A packed & protected Module Loader and more, for 64-bit Windows
  ☆27Mar 5, 2021Updated 4 years ago
• HoShiMin / formatPE

  View on GitHub
  A bunch of parsers for PE and PDB formats in C++
  ☆266May 15, 2024Updated last year
• MiroKaku / Nt-Modules

  View on GitHub
  Collect different versions of Crucial modules.
  ☆144Jul 11, 2024Updated last year
• vmcall / x64-vm

  View on GitHub
  x86-64 virtual machine and disassembler
  ☆147Nov 23, 2019Updated 6 years ago
• yjugl / mitimon

  View on GitHub
  Monitor ETW events for Windows process mitigation policies, with stack traces
  ☆31Oct 7, 2022Updated 3 years ago
• JustasMasiulis / wow64pp

  View on GitHub
  A modern c++ implementation of windows heavens gate
  ☆244Sep 19, 2020Updated 5 years ago
• dadas190 / Heavens-Gate-2.0

  View on GitHub
  Executes 64bit code from a 32bit process
  ☆241Jul 23, 2017Updated 8 years ago
• tsarpaul / WinRpcTutorial

  View on GitHub
  A working version of this tutorial: https://docs.microsoft.com/en-us/windows/desktop/rpc/tutorial
  ☆16Jun 22, 2019Updated 6 years ago
• avakar / vcrtl

  View on GitHub
  C++ Exceptions in Windows Drivers
  ☆221Dec 21, 2020Updated 5 years ago
• yardenshafir / SymlinkCallback

  View on GitHub
  A driver that hooks C: volume using symbolic link callback to track all FS access to the volume
  ☆110Apr 24, 2020Updated 5 years ago
• swwwolf / cbtest

  View on GitHub
  Windows kernel-mode callbacks tutorial driver
  ☆48Aug 8, 2016Updated 9 years ago
• MeeSong / KTL

  View on GitHub
  Windows Kernel Template Library
  ☆114Sep 13, 2022Updated 3 years ago
• wbenny / DetoursNT

  View on GitHub
  Detours with just single dependency - NTDLL
  ☆671Nov 25, 2025Updated 2 months ago
• huoji120 / Etw-Syscall

  View on GitHub
  https://key08.com/index.php/2021/10/19/1375.html
  ☆71May 11, 2022Updated 3 years ago
• Fyyre / oldsite

  View on GitHub
  fyyre.l2-fashion.de .. old site
  ☆17Apr 27, 2022Updated 3 years ago
• avalon1610 / ALPC

  View on GitHub
  Advance LPC
  ☆72May 2, 2017Updated 8 years ago
• hrbust86 / SvmNest

  View on GitHub
  a frame of amd-v svm nest
  ☆53Apr 7, 2020Updated 5 years ago
• 0xcpu / WinAltSyscallHandler

  View on GitHub
  Some research on AltSystemCallHandlers functionality in Windows 10 20H1 18999
  ☆239Nov 6, 2019Updated 6 years ago
• BadPlayer555 / KernelGDIDraw

  View on GitHub
  The program draws with win32k gdi functions in the kernel while NtGdiDdDDISubmitCommand is being hooked.
  ☆342Apr 27, 2020Updated 5 years ago
• SDXT / MMInject

  View on GitHub
  Kernel DLL Injector using NX Bit Swapping and VAD hide for hiding injected DLL
  ☆220Nov 12, 2020Updated 5 years ago
• aaaddress1 / wowInjector

  View on GitHub
  PoC: Exploit 32-bit Thread Snapshot of WOW64 to Take Over $RIP & Inject & Bypass Antivirus HIPS (HITB 2021)
  ☆167May 27, 2021Updated 4 years ago
• Fyyre / kerneldetective

  View on GitHub
  Kernel Detective
  ☆151Aug 12, 2022Updated 3 years ago
• Peribunt / Wow64-HeavensGate

  View on GitHub
  Basic utilities for executing, reading and writing 64-bit data in a 32-bit WoW64 process
  ☆19Jul 8, 2022Updated 3 years ago
• hyzhangzhy / WindowX

  View on GitHub
  给windows窗口全局添加一些功能。
  ☆21May 1, 2019Updated 6 years ago
• DownWithUp / ALPC-Example

  View on GitHub
  An example of a client and server using Windows' ALPC functions to send and receive data.
  ☆115Jan 21, 2025Updated last year
• yardenshafir / KernelDataStructureFinder

  View on GitHub
  Driver and WinDBG scripts to dump information about all resources and lookaside lists
  ☆66Apr 4, 2020Updated 5 years ago
• KelvinMsft / Notes

  View on GitHub
  Open Course for diving security internal
  ☆52Nov 11, 2019Updated 6 years ago
• JaanusKaapPublic / BlogHyperV

  View on GitHub
  Tools made for my Hyper-V blog series @ https://foxhex0ne.blogspot.com/
  ☆57Jun 21, 2020Updated 5 years ago
• 0xcpu / ExecutiveCallbackObjects

  View on GitHub
  Research on Windows Kernel Executive Callback Objects
  ☆315Feb 22, 2020Updated 5 years ago
• wbenny / KSOCKET

  View on GitHub
  KSOCKET provides a very basic example how to make a network connections in the Windows Driver by using WSK
  ☆541Sep 2, 2022Updated 3 years ago
• armasm / EasyAntiPatchGuard

  View on GitHub
  Easy Anti PatchGuard
  ☆223Apr 9, 2021Updated 4 years ago
• capt-meelo / NtCreateUserProcess

  View on GitHub
  Minimal PoC developed as discuss in https://captmeelo.com/redteam/maldev/2022/05/10/ntcreateuserprocess.html
  ☆143May 10, 2022Updated 3 years ago
• secrary / Hooking-via-InstrumentationCallback

  View on GitHub
  codes for my blog post: https://secrary.com/Random/InstrumentationCallback/
  ☆183Nov 30, 2017Updated 8 years ago
• A-Normal-User / NtSocket_NtClient_NtServer

  View on GitHub
  Using NtCreateFile and NtDeviceIoControlFile to realize the function of winsock（利用NtCreateFile和NtDeviceIoControlFile 实现winsock的功能）
  ☆127Sep 9, 2022Updated 3 years ago
• jxy-s / vfdynf

  View on GitHub
  Application Verifier Dynamic Fault Injection
  ☆40Jan 12, 2026Updated last month
• JustasMasiulis / nt_wrapper

  View on GitHub
  A wrapper library around native windows sytem APIs
  ☆447Feb 2, 2021Updated 5 years ago
• adrianyy / rw_socket_driver

  View on GitHub
  Driver that uses network sockets to communicate with client and read/ write protected process memory.
  ☆620Feb 22, 2019Updated 6 years ago