kkoha / EvtxCarvLinks
recovers and reconstructs fragmented Evtx files from disk images, memory dumps, pagefiles and unallocated space
☆13Updated 10 years ago
Alternatives and similar repositories for EvtxCarv
Users that are interested in EvtxCarv are comparing it to the libraries listed below
Sorting:
- Windows Kernel Mode PCRE☆10Updated 10 years ago
- Event Tracing for Windows Custom Events☆21Updated 10 years ago
- Handy WMI query tool.☆12Updated 9 years ago
- Windows device tree walker☆15Updated 7 years ago
- The project is a demo solution for one of the anti-rootkit techniques aimed on overcoming splicers☆35Updated 8 years ago
- windows kernel File redirection☆20Updated 11 years ago
- UI application that can compare PE images in memory or in raw PE file☆19Updated 11 years ago
- Reverse engineered vmware workstation code to aid in kernel debugging.☆14Updated 9 years ago
- ☆17Updated 8 years ago
- User-mode kernel callback framework☆10Updated 11 years ago
- Obtain remote process cookies by performing a brute-force attack on ntdll.RtlDecodePointer using known pointer encodings.☆22Updated 8 years ago
- ☆14Updated 10 years ago
- WoW64 -> x64☆19Updated 9 years ago
- ☆12Updated 8 years ago
- OpenHIPS prevents exploitation of Windows systems☆35Updated 12 years ago
- ☆14Updated 7 years ago
- profiling tool for analysising the games, get all the characteristic by hook d3d☆18Updated 11 years ago
- Native Development Kit for Vista 64bit And Later, by me, Based on NDK Headers 1.0, by Alex Ionescu☆17Updated 9 years ago
- The Windows driver and device management program for NDAS devices such as the NetDISK.☆16Updated 9 years ago
- Notes my learning steps about Windows-NT☆23Updated 8 years ago
- ☆12Updated 8 years ago
- PE Infector/Cryptor source code☆16Updated 8 years ago
- ☆14Updated 8 years ago
- ☆16Updated 9 years ago
- Window Executable file Function tracer using Debugging API☆44Updated 6 years ago
- A collection of Windows Administrator tools☆18Updated 11 years ago
- An aggregate of tools used in the core of vmp_dbg plus other parsing utils to parse vmp bc.☆16Updated 9 years ago
- ☆30Updated 7 years ago
- Lists work items being queued currently.☆14Updated 10 years ago
- ☆15Updated 7 years ago