kkent030315 / NtSymbol
Resolve DOS MZ executable symbols at runtime
☆93Updated 2 years ago
Related projects ⓘ
Alternatives and complementary repositories for NtSymbol
- ☆66Updated 3 years ago
- C++ library for parsing and manipulating PE files statically and dynamically.☆83Updated last year
- Documenting system information classes and their uses☆50Updated 3 years ago
- Some research on AltSystemCallHandlers functionality in Windows 10 20H1 18999☆204Updated 5 years ago
- APC Internals Research Code☆158Updated 4 years ago
- based on https://github.com/secrary/Hooking-via-InstrumentationCallback☆67Updated 5 years ago
- An automatic tool for fixing dumped PE files☆41Updated 4 years ago
- Browse Page Tables on Windows (Page Table Viewer)☆182Updated 2 years ago
- x64 syscall caller in C++.☆84Updated 6 years ago
- ☆121Updated 4 years ago
- codes for my blog post: https://secrary.com/Random/InstrumentationCallback/☆167Updated 6 years ago
- API Set resolver for Windows☆117Updated last month
- An example of a client and server using Windows' ALPC functions to send and receive data.☆89Updated 4 years ago
- ☆93Updated 7 years ago
- Obfuscate calls to imports by patching in stubs☆64Updated 3 years ago
- A driver that hooks C: volume using symbolic link callback to track all FS access to the volume☆102Updated 4 years ago
- DSE & PG bypass via BYOVD attack☆37Updated 7 months ago
- x64 Windows implementation of virtual-address to physical-address translation☆41Updated 3 years ago
- A proof of concept demonstrating instrumentation callbacks on Windows 10 21h1 with a TLS variable to ensure all syscalls are caught.☆117Updated 2 years ago
- IOCTLpus can be used to make DeviceIoControl requests with arbitrary inputs (with functionality somewhat similar to Burp Repeater).☆84Updated 2 years ago
- Three Tiny Examples of Directly Using Vista's NtCreateUserProcess☆85Updated 9 years ago
- Hygieia, a vulnerable driver traces scanner written in C++ as an x64 Windows kernel driver.☆135Updated 2 years ago
- Intercepting DeviceControl via WPP☆127Updated 4 years ago
- Simple project that demonstrates how an ETW consumer can be created just by using NTDLL☆134Updated 5 years ago
- arbitrary kernel read/write in dbutil_2_3.sys, Proof of Concept Local Privilege Escalation to nt authority/system☆53Updated 2 years ago
- Standalone program to download PDB Symbol files for debugging without WDK☆73Updated 5 years ago
- Bypassing code hooks detection in modern anti-rootkits via building faked PTE entries.☆72Updated 13 years ago
- Windows PDB parser for kernel-mode environment.☆87Updated last year
- Translates WinDbg "dt" structure dump to a C structure☆126Updated 8 years ago
- Integration of Microsoft Warbird with the MSVC compiler☆85Updated last year