☆33Dec 22, 2020Updated 5 years ago
Alternatives and similar repositories for FsMinfilterHooking
Users that are interested in FsMinfilterHooking are comparing it to the libraries listed below
Sorting:
- ☆51Jan 9, 2021Updated 5 years ago
- Demo to show how write ALPC Client & Server using native Ntdll.dll syscalls.☆21Jan 25, 2022Updated 4 years ago
- Source files for my posts☆17Jun 20, 2023Updated 2 years ago
- Static Library For Windows Drivers☆41Dec 13, 2025Updated 2 months ago
- research revolving the windows filtering platform callout mechanism☆39May 26, 2024Updated last year
- Detect removed thread from PspCidTable.☆75Mar 18, 2022Updated 3 years ago
- Code Integrity Violation Spotter☆17Jun 11, 2024Updated last year
- Walks the Process' VAD list to grab the PTE's corresponding to a usermode virtual address, all to get the physical address☆23Nov 22, 2021Updated 4 years ago
- A VMBR (Virtual-Machine Based Rootkit) which runs a guest OS and sends the attacker its data☆28Apr 27, 2024Updated last year
- ☆17Oct 31, 2022Updated 3 years ago
- Code to make it easier to write an NDIS network driver on Windows☆93Oct 1, 2023Updated 2 years ago
- a windows kernel keylogger that works☆20Feb 12, 2024Updated 2 years ago
- Data and structures regarding the research done on WdFilter☆12Apr 15, 2020Updated 5 years ago
- Simple command line tool to enumerate loaded WFP callout drivers☆10Feb 2, 2024Updated 2 years ago
- NASM listing to shellcode converter☆14May 6, 2018Updated 7 years ago
- A simple kernel mode driver that hooks some values at the KUSER_SHARED_DATA structure.☆27Jan 7, 2020Updated 6 years ago
- hooking KiUserApcDispatcher☆27Apr 3, 2017Updated 8 years ago
- A collection of cpuid instruction implementations for anti-vm purposes.☆10Oct 5, 2023Updated 2 years ago
- R3劫持所有异常☆15Jan 4, 2021Updated 5 years ago
- Ready-to-use headers for Windows Kernel SSDT indices☆11Apr 12, 2020Updated 5 years ago
- A driver that hooks C: volume using symbolic link callback to track all FS access to the volume☆109Apr 24, 2020Updated 5 years ago
- File system minifilter driver for Windows to block symbolic link attacks.☆51Dec 16, 2020Updated 5 years ago
- Hijack NotifyRoutine for a kernelmode thread☆41Jun 4, 2022Updated 3 years ago
- Detects if a Kernel mode debugger is active by reading the value of KUSER_SHARED_DATA.KdDebuggerEnabled. It is a high level and portable …☆23Sep 18, 2017Updated 8 years ago
- ☆14Jul 12, 2024Updated last year
- ☆16Oct 7, 2020Updated 5 years ago
- What makes it page☆17Aug 24, 2022Updated 3 years ago
- Source code on the 1.44MB 3.5 floppy accompanying the Windows NT File System Internals book.☆20Jul 31, 2019Updated 6 years ago
- Simple driver to register all available process, thread, image, Registry, and Object callbacks☆124Oct 5, 2017Updated 8 years ago
- Ransomware detection application for Windows using Windows Minifilter driver☆93Jun 6, 2020Updated 5 years ago
- Use ci.dll API for validating Authenticode signature of files☆167Mar 28, 2022Updated 3 years ago
- NT AUTHORITY\SYSTEM☆43Jul 8, 2020Updated 5 years ago
- Files for http://blog.deniable.org/posts/windows-callbacks/☆77Feb 26, 2022Updated 4 years ago
- ☆20Mar 15, 2023Updated 2 years ago
- Exploits Intel's signed iqvw64e.sys driver to allow manual mapping and read/writing of memory at a kernel level.☆13Jun 1, 2019Updated 6 years ago
- Some drivers I've written while solving exercises from Practical Reverse Engineering☆15Jan 9, 2022Updated 4 years ago
- ☆85Jan 12, 2022Updated 4 years ago
- a dumb rpm/wpm example driver☆15Jun 7, 2021Updated 4 years ago
- ☆17Apr 21, 2022Updated 3 years ago