Vicshann / GhostDbg
Noninvasive debugging plugin for X64Dbg
☆101Updated 2 months ago
Alternatives and similar repositories for GhostDbg:
Users that are interested in GhostDbg are comparing it to the libraries listed below
- fix vmprotect import function used unicorn-engine.☆92Updated last year
- ayy debuger☆88Updated 11 months ago
- This x64dbg plugin sets the page protection for memory mapped views in scenarios which cause NtProtectVirtualMemory to fail.☆113Updated 7 years ago
- ☆94Updated 7 years ago
- VMP Mutation API Fix☆40Updated 3 years ago
- VM devirtualization PoC based on AsmJit and llvm☆112Updated 3 years ago
- Global DLL injector☆66Updated 3 years ago
- A ProcMon-esque tool for monitoring Windows Kernel Drivers☆54Updated 3 years ago
- A general solution to simulate execution of virtualized instructions (vmprotect/themida, etc.).☆71Updated 3 years ago
- Kernel-Mode extended version of https://github.com/microsoft/Detours☆153Updated 2 years ago
- disable most common windowsx64 systems patchguard☆84Updated 6 years ago
- Ghetto user mode emulation of Windows kernel drivers.☆131Updated 4 months ago
- Some psuedo snippets from BattlEye's BEDaisy.sys loaded on Rainbow Six: Siege.☆123Updated 2 years ago
- Collect different versions of Crucial modules.☆129Updated 7 months ago
- ☆123Updated 4 years ago
- VMP 3.5 - VMP 3.7.2 Full Protect Anti Debugger Fuxker☆67Updated 2 years ago
- a Windows kernel Pdb parsing and downloading library that running purely in kernel mode without any R3 programs.☆150Updated 5 months ago
- Windows Driver Kit Extesion Header (Undoc)☆132Updated 3 years ago
- Static user/kernel mode library that allows access to all functions and global variables by extracting offsets from the PDB☆80Updated last year
- A repository of IDA Databases and Binaries used for the analysis of popular commercial virtual-machine obfuscators☆68Updated 2 years ago
- VMProtect, VMP, Devirter, 3,5☆106Updated 2 years ago
- A plugin to x64dbg that lets you find out what writes to/accesses particular address☆92Updated 4 years ago
- ☆96Updated 2 years ago
- 可在非测试模式下符号化读取内核内存。Kernel memory can be read symbolically in non test mode。☆107Updated 2 years ago
- 🔎 Analysis of Oreans: Looking inside Themida, WinLicense, and CodeVirtualizer☆34Updated 4 years ago
- An Ark tool project,run on Win7 x86/x64☆113Updated 7 years ago
- ☆163Updated 2 years ago
- A dynamic VMP dumper and import fixer, powered by VTIL.☆41Updated 4 years ago
- A hypervisor hiding user-mode memory using EPT☆106Updated 7 years ago
- StrongOD(anti anti-debug plugin) driver source code.☆116Updated 7 years ago