Alternatives and similar repositories for PTView

Users that are interested in PTView are comparing it to the libraries listed below

• can1357 / NtRays

  View on GitHub
  Hex-Rays microcode plugin for automated simplification of Windows Kernel decompilation.
  ☆643Jan 28, 2025Updated last year
• waryas / KACE

  View on GitHub
  Emulate Drivers in RING3 with self context mapping or unicorn
  ☆365Aug 18, 2022Updated 3 years ago
• jonomango / nohv

  View on GitHub
  Kernel driver for detecting Intel VT-x hypervisors.
  ☆192Jul 11, 2023Updated 2 years ago
• 1401199262 / NMIStackWalk

  View on GitHub
  ☆73Aug 31, 2022Updated 3 years ago
• KiFilterFiberContext / warbird-hook

  View on GitHub
  Using Microsoft Warbird to automatically unpack and execute encrypted shellcode in ClipSp.sys without triggering PatchGuard
  ☆265Aug 31, 2022Updated 3 years ago
• Sinclairq / tp-emulator

  View on GitHub
  A basic 100 loc CPU emulator using the existing code of ntoskrnl.exe
  ☆75Aug 16, 2023Updated 2 years ago
• wbaby / DoubleCallBack

  View on GitHub
  ☆184May 20, 2022Updated 3 years ago
• Deputation / pagewalkr

  View on GitHub
  An x64 page table iterator written in C++ as a kernel mode windows driver.
  ☆119May 25, 2021Updated 4 years ago
• KANKOSHEV / Detect-HiddenThread-via-KPRCB

  View on GitHub
  Detect removed thread from PspCidTable.
  ☆75Mar 18, 2022Updated 3 years ago
• Deputation / hygieia

  View on GitHub
  Hygieia, a vulnerable driver traces scanner written in C++ as an x64 Windows kernel driver.
  ☆150Feb 12, 2022Updated 4 years ago
• ekknod / acdrv

  View on GitHub
  base for testing
  ☆186Sep 28, 2024Updated last year
• Xyrem / Yumekage

  View on GitHub
  Demo proof of concept for shadow regions, and implementation of HyperDeceit.
  ☆313May 31, 2023Updated 2 years ago
• zer0condition / ZeroThreadKernel

  View on GitHub
  Recursive and arbitrary code execution at kernel-level without a system thread creation
  ☆159Apr 13, 2023Updated 2 years ago
• 1401199262 / Hook-KdTrap

  View on GitHub
  ☆223Mar 11, 2023Updated 2 years ago
• Air14 / airhv

  View on GitHub
  Simple Intel VT-x hypervisor
  ☆359Dec 10, 2023Updated 2 years ago
• Oliver-1-1 / EtwKeyboardDetection

  View on GitHub
  ☆37Sep 26, 2024Updated last year
• therealdreg / ida_vmware_windows_gdb

  View on GitHub
  Helper script for Windows kernel debugging with IDA Pro on VMware + GDB stub (including PDB symbols)
  ☆68Aug 11, 2023Updated 2 years ago
• momo5502 / hypervisor

  View on GitHub
  🧪 Hypervisor with EPT hooking support.
  ☆308Jan 1, 2026Updated last month
• momo5502 / ept-hook-detection

  View on GitHub
  🪝 Various EPT hook detection approaches
  ☆143Jul 29, 2025Updated 6 months ago
• MapleSwan / PageTableHook

  View on GitHub
  ☆144Dec 10, 2022Updated 3 years ago
• charliewolfe / Stealthy-Kernelmode-Injector

  View on GitHub
  Manual mapper that uses PTE manipulation, Virtual Address Descriptor (VAD) manipulation, and forceful memory allocation to hide executabl…
  ☆382Jan 29, 2022Updated 4 years ago
• wallds / NoVmpy

  View on GitHub
  ☆421Jan 1, 2025Updated last year
• donnaskiez / nmi

  View on GitHub
  nmi stackwalking + module verification
  ☆157Dec 28, 2023Updated 2 years ago
• Cr4sh / KernelForge

  View on GitHub
  A library to develop kernel level Windows payloads for post HVCI era
  ☆483May 18, 2021Updated 4 years ago
• Oliver-1-1 / GhostMapper

  View on GitHub
  ☆355May 11, 2025Updated 9 months ago
• MapleSwan / enum_real_dirbase

  View on GitHub
  从MmPfnData中枚举进程和页目录基址
  ☆205Aug 18, 2023Updated 2 years ago
• Air14 / SymbolicAccess

  View on GitHub
  Static user/kernel mode library that allows access to all functions and global variables by extracting offsets from the PDB
  ☆117May 29, 2025Updated 8 months ago
• VollRagm / lpmapper

  View on GitHub
  A mapper that maps shellcode into loaded large page drivers
  ☆321Apr 26, 2022Updated 3 years ago
• stdhu / windows-kernel-pagehook

  View on GitHub
  windows kernel pagehook
  ☆41Oct 30, 2022Updated 3 years ago
• hfiref0x / KDU

  View on GitHub
  Kernel Driver Utility
  ☆2,402Jan 11, 2026Updated last month
• armasm / EasyAntiPatchGuard

  View on GitHub
  Easy Anti PatchGuard
  ☆223Apr 9, 2021Updated 4 years ago
• kkent030315 / anycall

  View on GitHub
  x64 Windows kernel code execution via user-mode, arbitrary syscall, vulnerable IOCTLs demonstration
  ☆384Jul 6, 2022Updated 3 years ago
• donnaskiez / ac

  View on GitHub
  kernel mode anti cheat
  ☆628Aug 4, 2024Updated last year
• IcEy-999 / Kernel-Special-APC-ReadProcessMemory

  View on GitHub
  Example of reading process memory through kernel special APC
  ☆110Apr 21, 2023Updated 2 years ago
• SamuelTulach / meme-rw

  View on GitHub
  Archive R/W into any protected process by changing the value of KTHREAD->PreviousMode
  ☆163Jul 31, 2022Updated 3 years ago
• SamuelTulach / HookGuard

  View on GitHub
  Hooking Windows' exception dispatcher to protect process's PML4
  ☆225Jan 24, 2025Updated last year
• 1401199262 / HookSwapContext

  View on GitHub
  ☆34Apr 11, 2023Updated 2 years ago
• ByteWhite1x1 / Driver-DKOM

  View on GitHub
  An advanced DKOM for drivers with "DRIVER_OBJECT"
  ☆22Feb 19, 2023Updated 2 years ago
• cs1ime / DICHook

  View on GitHub
  Hook NtDeviceIoControlFile with PatchGuard
  ☆107May 10, 2022Updated 3 years ago