KiFilterFiberContext / windows-software-policy
Research on obfuscated licensing APIs / CLIP service in the Windows kernel
☆108Updated 2 years ago
Alternatives and similar repositories for windows-software-policy:
Users that are interested in windows-software-policy are comparing it to the libraries listed below
- Reimplementation of Microsoft's Warbird obuscator☆116Updated 9 months ago
- Integration of Microsoft Warbird with the MSVC compiler☆98Updated last year
- Using Microsoft Warbird to automatically unpack and execute encrypted shellcode in ClipSp.sys without triggering PatchGuard☆244Updated 2 years ago
- Converted phnt (Native API header files from the System Informer project) to IDA TIL, IDC (Hex-Rays).☆132Updated 7 months ago
- WinLicense key extraction via Intel PIN☆100Updated 11 months ago
- ☆142Updated last year
- uefi diskless persistence technique + OVMF secureboot bypass☆61Updated 11 months ago
- The Windbg extensions to study Hyper-V on Intel and AMD processors.☆151Updated 2 weeks ago
- 🎨 Seamlessly convert your favorite Visual Studio Code themes to IDA Pro themes.☆98Updated 11 months ago
- Documentation of Microsoft's Warbird obfuscation☆49Updated 6 months ago
- Demystifying PatchGuard is a comprehensive analysis of Microsoft's security feature called PatchGuard, which is designed to prevent unaut…☆117Updated last year
- Resolve DOS MZ executable symbols at runtime☆96Updated 3 years ago
- Bootkit for Windows Sandbox to disable DSE/PatchGuard.☆274Updated 5 months ago
- Makes IDA (most versions) to crash upon opening it.☆82Updated 6 months ago
- Hooking Windows' exception dispatcher to protect process's PML4☆155Updated 2 months ago
- A Binary Ninja plugin to detect Themida, WinLicense and Code Virtualizer's obfuscated code locations.☆77Updated 7 months ago
- bypassing intel txt's tboot integrity checks via coreboot shim☆63Updated last week
- unorthodox approach to analyze a trace, but this helped me get comfy with x64 instructions overall (excluding sse/avx/etc lol), cleared u…☆57Updated last year
- A collection of tools, source code, and papers researching Windows' implementation of CET.☆81Updated 4 years ago
- CMake template for a basic EFI application/bootkit. This library is header-only, there is no EDK2 runtime!).☆77Updated 2 years ago
- ☆70Updated 2 years ago
- Windows PDB parser for kernel-mode environment.☆95Updated 2 years ago
- A C compiler targeting an artistically pleasing nightmare for reverse engineers☆97Updated 3 months ago
- Helper script for Windows kernel debugging with IDA Pro on VMware + GDB stub (including PDB symbols)☆63Updated last year
- Global user-mode hooking framework, based on AppInit_DLLs. The goal is to allow you to rapidly develop hooks to inject in an arbitrary pr…☆167Updated 3 years ago
- Windows kernel debugger for Linux hosts running Windows under KVM/QEMU☆70Updated 4 months ago
- Ghetto user mode emulation of Windows kernel drivers.☆132Updated 5 months ago
- An x64dbg plugin which helps make sense of long C++ symbols☆59Updated last year
- Using Windows' own bootloader as a shim to bypass Secure Boot☆168Updated 8 months ago
- Contains all the applications developed for the Second part of the 7th Edition of Windows Internals book☆107Updated 8 months ago