jschicht / EaTools
Analysis and manipulation of extended attribute ($EA) on NTFS
☆38Updated 9 years ago
Alternatives and similar repositories for EaTools:
Users that are interested in EaTools are comparing it to the libraries listed below
- Parse Microsoft shim databases☆30Updated 2 months ago
- A set of tools to retrieve and parse TCG measured boot logs. Microsoft refers to these as Windows Boot Confirguration Logs (WBCL). In ord…☆54Updated 6 years ago
- Example/starter code for custom Windows application compatibility shims☆33Updated 4 years ago
- Metadata hash incorporating the Rich Header for robustness against packing and other malware tricks☆64Updated 3 years ago
- A collection of free miscellaneous Windows tools☆131Updated 6 months ago
- NTFS samples☆25Updated 4 years ago
- Library and tools to access the Windows Prefetch File (SCCA) format.☆73Updated 2 months ago
- Named pipe I/O ETW provider for Windows☆69Updated 4 years ago
- Powerful commandline $MFT record editor.☆23Updated 9 years ago
- The content of this repository aims to assist efforts on analysing inner working principles, functionalities, and properties of the Micro…☆151Updated 4 years ago
- A local copy of Alex Ionescu's seemingly abandoned native-nt-toolkit project containing knowledge inherited from the ReactOS project.☆54Updated 5 years ago
- BCD is a module to interact with boot configuration data (BCD) either locally or remotely using the ROOT/WMI:Bcd* WMI classes. The functi…☆60Updated 4 years ago
- This tool is the result of a reverse engineering process of the Windows service called SysMain. Time to interact with the prefetch files …☆31Updated 4 years ago
- Lnk file parser☆81Updated last month
- WNF Utilities 4 Newbies (WNFUN)☆94Updated 6 years ago
- ☆67Updated 2 years ago
- Scripts to prepare Windows system for debugging.☆30Updated 4 years ago
- Extension blocks as found in ShellBags and other places in the Registry☆24Updated 2 months ago
- Expand compressed files from WinSxS folder☆153Updated 8 months ago
- BITS Transfers Manager☆40Updated 2 years ago
- extract and parse WEVT_TEMPLATEs from PE files☆18Updated last year
- A PowerShell module to assist in parsing and managing catalog files.☆21Updated 8 years ago
- A GUI version of the classic PoolMon tool☆112Updated 6 years ago
- Tool to convert SDDL to readable text☆40Updated 6 years ago
- ☆33Updated last year
- API Set Viewer☆88Updated last month
- AppContainer and LPAC (Less Privileged AppContainer) Launcher with Capabilities☆59Updated 5 months ago
- Diff tool for comparing symbols in PDB files☆84Updated 5 years ago
- Library and tools to access the Windows NT Registry File (REGF) format☆115Updated 6 months ago
- A tool for Windows that can make any program work within file-system transactions.☆57Updated 4 years ago