ch3rn0byl / WinDbg-Extensions
☆17Updated 3 years ago
Related projects ⓘ
Alternatives and complementary repositories for WinDbg-Extensions
- Helper Script to convert a Windbg dumped structure (using the 'dt' command) into a C structure. It creates dummy structs for you if neede…☆26Updated last year
- Support Windows OS Reversing by searching easily for references to functions across many DLLs☆33Updated 2 years ago
- ☆27Updated 2 years ago
- Clone running process with ZwCreateProcess☆58Updated 4 years ago
- Command like tool to print mitigation flags for running processes in a memory dump☆44Updated 4 years ago
- allowing um r/w through km from um ioctl ™☆12Updated 2 years ago
- Demonstrate calling a kernel function and handle process creation callback against HVCI☆48Updated last year
- ☆15Updated 3 years ago
- ☆57Updated 2 years ago
- arbitrary kernel read/write in dbutil_2_3.sys, Proof of Concept Local Privilege Escalation to nt authority/system☆53Updated 2 years ago
- Tiny driver patch to allow kernel callbacks to work on Win10 21h1☆31Updated 2 years ago
- ☆24Updated 11 months ago
- ☆25Updated 3 years ago
- ☆29Updated 2 years ago
- A ready-made template for a project based on libpeconv.☆40Updated 2 weeks ago
- Enabled / Disable LSA Protection via BYOVD☆62Updated 2 years ago
- A Practical example of ELAM (Early Launch Anti-Malware)☆30Updated 2 years ago
- Extract data of TTD trace file to a minidump☆28Updated last year
- A PoC tool for exploiting leaked process and thread handles☆30Updated 8 months ago
- ☆31Updated 4 years ago
- Dumps information about all the callback objects found in a dump file and the functions registered for them☆34Updated 4 years ago
- An experimental dynamic malware unpacker based on Intel Pin and PE-sieve☆57Updated 2 months ago
- A kernel mode Windows rootkit in development.☆49Updated 2 years ago
- Windows kernel PDB data parsed into YAML☆31Updated 10 months ago
- Monitors ETW for security relevant syscalls maintaining the set called by each unique process☆49Updated last year
- Manually perform syscalls without going through any external API or DLL.☆16Updated last year
- Local OXID Resolver (LCLOR) : Research and Tooling☆33Updated 3 years ago
- ☆32Updated 3 years ago
- ☆12Updated last year