gmh5225 / ntoskrnl_file_collectionLinks
Collect various versions of ntoskrnl files
☆59Updated 2 years ago
Alternatives and similar repositories for ntoskrnl_file_collection
Users that are interested in ntoskrnl_file_collection are comparing it to the libraries listed below
Sorting:
- ☆127Updated 5 years ago
- ☆74Updated 7 years ago
- Collect different versions of Crucial modules.☆144Updated last year
- Windows PDB parser for kernel-mode environment.☆103Updated 7 months ago
- ☆144Updated 3 years ago
- An example of a client and server using Windows' ALPC functions to send and receive data.☆115Updated last year
- This project migrated to https://github.com/backengineering/llvm-msvc☆83Updated 2 years ago
- 收集常用windows版本内核文件☆35Updated 2 years ago
- A basic 100 loc CPU emulator using the existing code of ntoskrnl.exe☆75Updated 2 years ago
- Use ci.dll API for validating Authenticode signature of files☆164Updated 3 years ago
- first commit☆64Updated 5 years ago
- a monitoring windows driver calls kernel api tools☆126Updated last year
- based on https://github.com/secrary/Hooking-via-InstrumentationCallback☆73Updated 6 years ago
- Demystifying PatchGuard is a comprehensive analysis of Microsoft's security feature called PatchGuard, which is designed to prevent unaut…☆132Updated 2 years ago
- Kernel driver for detecting Intel VT-x hypervisors.☆192Updated 2 years ago
- windows kernel pagehook☆40Updated 3 years ago
- ☆73Updated 3 years ago
- Static user/kernel mode library that allows access to all functions and global variables by extracting offsets from the PDB☆117Updated 8 months ago
- InfinityHookProMax: Make InfinityHook great great again☆51Updated 2 years ago
- x64 Windows implementation of virtual-address to physical-address translation☆46Updated 4 years ago
- Detect-KeAttachProcess by iterating through all processes as well as checking the context of the thread.☆118Updated 3 years ago
- detect hypervisor with Nmi Callback☆42Updated 3 years ago
- A ProcMon-esque tool for monitoring Windows Kernel Drivers☆61Updated 4 years ago
- ☆99Updated 8 years ago
- Hiding a system thread against conventional means of detection☆41Updated 5 years ago
- ☆128Updated 2 years ago
- 让Etwhook再次伟大! Make InfinityHook Great Again!☆147Updated 4 years ago
- Using MMIO (Memory-Mapped I/O) to read TPM 2.0 public Endorsement Key.☆52Updated last year
- D☆43Updated 4 years ago
- 可在非测试模式下符号化读取内核内存。Kernel memory can be read symbolically in non test mode。☆109Updated 3 years ago