MartinDrab / IRPMonLinks
The goal of the tool is to monitor requests received by selected device objects or kernel drivers. The tool is quite similar to IrpTracker but has several enhancements. It supports 64-bit versions of Windows (no inline hooks are used, only moodifications to driver object structures are performed) and monitors IRP, FastIo, AddDevice, DriverUnload…
☆387Updated 5 months ago
Alternatives and similar repositories for IRPMon
Users that are interested in IRPMon are comparing it to the libraries listed below
Sorting:
- WinDBG Anti-RootKit Extension☆630Updated 4 years ago
- Syscall Monitor is a system monitor program (like Sysinternal's Process Monitor) using Intel VT-X/EPT for Windows7+☆741Updated 7 years ago
- Windows NT x64 syscall fuzzer☆607Updated last year
- PatchGuard Research☆301Updated 6 years ago
- Research on Windows Kernel Executive Callback Objects☆287Updated 5 years ago
- Detours with just single dependency - NTDLL☆644Updated 2 years ago
- Source code for File Test - Interactive File System Test Tool☆284Updated 2 months ago
- Persistent IAT hooking application - based on bearparser☆258Updated 2 years ago
- windows syscall table from xp ~ 10 rs4☆353Updated 6 years ago
- ☆226Updated 3 years ago
- SimpleSvmHook is a research purpose hypervisor for Windows on AMD processors.☆397Updated 4 years ago
- zer0m0n driver for cuckoo sandbox☆362Updated 10 years ago
- DriverBuddy is an IDA Python script to assist with the reverse engineering of Windows kernel drivers.☆362Updated 5 years ago
- Monitor activity of any driver☆336Updated 4 years ago
- The Windows Library for Intel Process Trace (WinIPT) is a project that leverages the new Intel Processor Trace functionality exposed by W…☆383Updated 2 years ago
- kHypervisor is a lightweight bluepill-like nested VMM for Windows, it provides and emulating a basic function of Intel VT-x☆426Updated 3 years ago
- This driver implements the Intel Processor Trace functionality in Intel Skylake architecture for Microsoft Windows☆450Updated 7 years ago
- Defeating Patchguard universally for Windows 8, Windows 8.1 and all versions of Windows 10 regardless of HVCI.☆876Updated 5 years ago
- A tool to help when dealing with Windows IOCTL codes or reversing Windows drivers.☆434Updated 6 years ago
- pseudo-code to show how to disable patchguard with win10☆295Updated 7 years ago
- ☆398Updated 8 years ago
- Examples of leaking Kernel Mode information from User Mode on Windows☆604Updated 7 years ago
- Universal PatchGuard and Driver Signature Enforcement Disable☆843Updated 6 years ago
- Minimalistic VT-x hypervisor with hooks☆872Updated 5 years ago
- Detecting execution of kernel memory where is not backed by any image file☆258Updated 6 years ago
- pdbex is a utility for reconstructing structures and unions from the PDB into compilable C headers☆861Updated 9 months ago
- Labeless is a multipurpose IDA Pro plugin system for labels/comments synchronization with a debugger backend, with complex memory dumping…☆551Updated 4 months ago
- kernel-mode Anti-Anti-Debug plugin. based on intel vt-x && ept technology☆438Updated 4 years ago
- MemoryRanger protects kernel data and code by running drivers and hosting data in isolated kernel enclaves using VT-x and EPT features. M…☆226Updated 4 years ago
- Debug Child Process Tool (auto attach)☆290Updated last year