kkent030315 / NtSymbol
Resolve DOS MZ executable symbols at runtime
☆93Updated 3 years ago
Related projects ⓘ
Alternatives and complementary repositories for NtSymbol
- ☆66Updated 3 years ago
- Some research on AltSystemCallHandlers functionality in Windows 10 20H1 18999☆205Updated 5 years ago
- Documenting system information classes and their uses☆50Updated 3 years ago
- C++ library for parsing and manipulating PE files statically and dynamically.☆87Updated last year
- codes for my blog post: https://secrary.com/Random/InstrumentationCallback/☆169Updated 6 years ago
- APC Internals Research Code☆158Updated 4 years ago
- Ghetto user mode emulation of Windows kernel drivers.☆122Updated last month
- Demystifying PatchGuard is a comprehensive analysis of Microsoft's security feature called PatchGuard, which is designed to prevent unaut…☆106Updated last year
- ☆93Updated 7 years ago
- Obfuscate calls to imports by patching in stubs☆64Updated 3 years ago
- File system minifilter driver for Windows to block symbolic link attacks.☆51Updated 3 years ago
- Simple project that demonstrates how an ETW consumer can be created just by using NTDLL☆135Updated 5 years ago
- Bypassing code hooks detection in modern anti-rootkits via building faked PTE entries.☆73Updated 13 years ago
- Browse Page Tables on Windows (Page Table Viewer)☆185Updated 2 years ago
- ☆121Updated 4 years ago
- A driver that hooks C: volume using symbolic link callback to track all FS access to the volume☆102Updated 4 years ago
- A proof of concept demonstrating instrumentation callbacks on Windows 10 21h1 with a TLS variable to ensure all syscalls are caught.☆117Updated 3 years ago
- Intercepting DeviceControl via WPP☆127Updated 5 years ago
- A collection of tools, source code, and papers researching Windows' implementation of CET.☆74Updated 4 years ago
- arbitrary kernel read/write in dbutil_2_3.sys, Proof of Concept Local Privilege Escalation to nt authority/system☆53Updated 3 years ago
- An example of a client and server using Windows' ALPC functions to send and receive data.☆89Updated 4 years ago
- based on https://github.com/secrary/Hooking-via-InstrumentationCallback☆67Updated 5 years ago
- DSE & PG bypass via BYOVD attack☆37Updated 7 months ago
- Windows PDB parser for kernel-mode environment.☆90Updated last year
- x64 Windows PatchGuard bypass, register process-creation callbacks from unsigned code☆196Updated 3 years ago
- An automatic tool for fixing dumped PE files☆41Updated 4 years ago
- Converted phnt (Native API header files from the System Informer project) to IDA TIL, IDC (Hex-Rays).☆115Updated 2 months ago
- ☆153Updated 5 years ago
- Integration of Microsoft Warbird with the MSVC compiler☆85Updated last year
- A quick-and-dirty anti-hook library proof of concept.☆101Updated 6 years ago