Alternatives and similar repositories for NtRays

Users that are interested in NtRays are comparing it to the libraries listed below

• can1357 / HexSuite

  View on GitHub
  Header only wrapper around Hex-Rays API in C++20.
  ☆168Dec 25, 2024Updated last year
• can1357 / ByePg

  View on GitHub
  Defeating Patchguard universally for Windows 8, Windows 8.1 and all versions of Windows 10 regardless of HVCI.
  ☆901Nov 21, 2019Updated 6 years ago
• JustasMasiulis / ida_bitfields

  View on GitHub
  IDA Pro plugin to make bitfield accesses easier to grep
  ☆251Aug 3, 2025Updated 6 months ago
• wallds / NoVmpy

  View on GitHub
  ☆421Jan 1, 2025Updated last year
• VollRagm / PTView

  View on GitHub
  Browse Page Tables on Windows (Page Table Viewer)
  ☆234Apr 2, 2022Updated 3 years ago
• iPower / KasperskyHook

  View on GitHub
  Hook system calls on Windows by using Kaspersky's hypervisor
  ☆1,272Apr 1, 2024Updated last year
• can1357 / selene

  View on GitHub
  Kernel-mode Paravirtualization in Ring 2, LLVM based linker, and some other things!
  ☆408Apr 19, 2025Updated 9 months ago
• waryas / KACE

  View on GitHub
  Emulate Drivers in RING3 with self context mapping or unicorn
  ☆365Aug 18, 2022Updated 3 years ago
• HoShiMin / Kernel-Bridge

  View on GitHub
  Windows kernel hacking framework, driver template, hypervisor and API written on C++
  ☆1,802Nov 12, 2023Updated 2 years ago
• Cr4sh / KernelForge

  View on GitHub
  A library to develop kernel level Windows payloads for post HVCI era
  ☆483May 18, 2021Updated 4 years ago
• armasm / EasyAntiPatchGuard

  View on GitHub
  Easy Anti PatchGuard
  ☆223Apr 9, 2021Updated 4 years ago
• avakar / vcrtl

  View on GitHub
  C++ Exceptions in Windows Drivers
  ☆221Dec 21, 2020Updated 5 years ago
• mike1k / HookHunter

  View on GitHub
  Analyze patches in a process
  ☆259Jul 28, 2021Updated 4 years ago
• VoidSec / DriverBuddyReloaded

  View on GitHub
  Driver Buddy Reloaded is an IDA Pro Python plugin that helps automate some tedious Windows Kernel Drivers reverse engineering tasks
  ☆411Jul 4, 2025Updated 7 months ago
• 9176324 / Shark

  View on GitHub
  Turn off PatchGuard in real time for win7 (7600) ~ later
  ☆1,038Apr 21, 2022Updated 3 years ago
• KiFilterFiberContext / warbird-hook

  View on GitHub
  Using Microsoft Warbird to automatically unpack and execute encrypted shellcode in ClipSp.sys without triggering PatchGuard
  ☆265Aug 31, 2022Updated 3 years ago
• can1357 / NtLua

  View on GitHub
  Lua in kernel-mode because why not.
  ☆367Dec 3, 2021Updated 4 years ago
• archercreat / vmpfix

  View on GitHub
  Universal x86/x64 VMProtect 2.0-3.X Import fixer
  ☆20Dec 29, 2021Updated 4 years ago
• snowsnowsnows / EagleVM

  View on GitHub
  Native code virtualizer for x64 binaries
  ☆515Dec 20, 2024Updated last year
• jonomango / nohv

  View on GitHub
  Kernel driver for detecting Intel VT-x hypervisors.
  ☆192Jul 11, 2023Updated 2 years ago
• gmh5225 / CallMeWin32kDriver

  View on GitHub
  Load your driver like win32k.sys
  ☆258Aug 20, 2022Updated 3 years ago
• can1357 / NoVmp

  View on GitHub
  A static devirtualizer for VMProtect x64 3.x. powered by VTIL.
  ☆2,080Aug 8, 2021Updated 4 years ago
• 0xnobody / vmpattack

  View on GitHub
  A VMP to VTIL lifter.
  ☆446May 20, 2021Updated 4 years ago
• mike1k / perses

  View on GitHub
  X86 Mutation Engine with Portable Executable compatibility.
  ☆532May 24, 2022Updated 3 years ago
• can1357 / hvdetecc

  View on GitHub
  Collection of hypervisor detections
  ☆295Sep 25, 2024Updated last year
• jxy-s / stlkrn

  View on GitHub
  C++ STL in the Windows Kernel with C++ Exception Support
  ☆434Aug 16, 2023Updated 2 years ago
• mandiant / STrace

  View on GitHub
  A DTrace on Windows Reimplementation
  ☆369Feb 3, 2026Updated last week
• Zero-Tang / NoirVisor

  View on GitHub
  The Grimoire Hypervisor solution for x86 Processors with experimental nested virtualization support. Remastering with Rust in progress.
  ☆606Feb 1, 2026Updated 2 weeks ago
• HyperDbg / HyperDbg

  View on GitHub
  State-of-the-art native debugging tools
  ☆3,627Updated this week
• airbus-cert / ttddbg

  View on GitHub
  Time Travel Debugging IDA plugin
  ☆593Jun 27, 2024Updated last year
• hfiref0x / KDU

  View on GitHub
  Kernel Driver Utility
  ☆2,402Jan 11, 2026Updated last month
• tandasat / SimpleSvmHook

  View on GitHub
  SimpleSvmHook is a research purpose hypervisor for Windows on AMD processors.
  ☆460Feb 18, 2021Updated 4 years ago
• vtil-project / VTIL-Core

  View on GitHub
  Virtual-machine Translation Intermediate Language
  ☆1,460Nov 5, 2023Updated 2 years ago
• hzqst / unicorn_pe

  View on GitHub
  Unicorn PE is an unicorn based instrumentation project designed to emulate code execution for windows PE files.
  ☆914Dec 29, 2025Updated last month
• FiYHer / InfinityHookPro

  View on GitHub
  InfinityHookPro Win7 -> Win11 latest
  ☆551Feb 7, 2023Updated 3 years ago
• changeofpace / Self-Remapping-Code

  View on GitHub
  This program remaps its image to prevent the page protection of pages contained in the image from being modified via NtProtectVirtualMemo…
  ☆631Mar 19, 2019Updated 6 years ago
• 0xnobody / vmpdump

  View on GitHub
  A dynamic VMP dumper and import fixer, powered by VTIL.
  ☆1,320Nov 4, 2020Updated 5 years ago
• HexRaysSA / goomba

  View on GitHub
  gooMBA is a Hex-Rays Decompiler plugin to simplify Mixed Boolean-Arithmetic (MBA) expressions
  ☆668Nov 10, 2025Updated 3 months ago
• wbenny / pdbex

  View on GitHub
  pdbex is a utility for reconstructing structures and unions from the PDB into compilable C headers
  ☆890Jun 18, 2025Updated 7 months ago