ntdiff / headers
☆151Updated last month
Related projects ⓘ
Alternatives and complementary repositories for headers
- Translates WinDbg "dt" structure dump to a C structure☆126Updated 8 years ago
- ☆120Updated last month
- Research on Windows Kernel Executive Callback Objects☆278Updated 4 years ago
- Some research on AltSystemCallHandlers functionality in Windows 10 20H1 18999☆205Updated 5 years ago
- Simple project that demonstrates how an ETW consumer can be created just by using NTDLL☆135Updated 5 years ago
- Hyper-V Research is trendy now☆150Updated last month
- A driver that hooks C: volume using symbolic link callback to track all FS access to the volume☆102Updated 4 years ago
- An example of a client and server using Windows' ALPC functions to send and receive data.☆89Updated 4 years ago
- C++ Exceptions in Windows Drivers☆198Updated 3 years ago
- Collect different versions of Crucial modules.☆127Updated 4 months ago
- APC Internals Research Code☆158Updated 4 years ago
- ☆121Updated 4 years ago
- MemoryRanger protects kernel data and code by running drivers and hosting data in isolated kernel enclaves using VT-x and EPT features. M…☆219Updated 4 years ago
- hook msr by amd svm☆119Updated 4 years ago
- CallMon is an experimental system call monitoring tool that works on Windows 10 versions 2004+ using PsAltSystemCallHandlers☆129Updated 4 years ago
- ntdll.h - compatible with MSVC 6.0, Intel C++ Compiler and MinGW. Serves as a complete replacement for Windows.h☆130Updated 5 years ago
- Hyper-V Research is trendy now☆172Updated 6 months ago
- pseudo-code to show how to disable patchguard with win10☆295Updated 6 years ago
- Header only wrapper around Hex-Rays API in C++20.☆151Updated 2 years ago
- Resolve DOS MZ executable symbols at runtime☆93Updated 3 years ago
- Simple driver to register all available process, thread, image, Registry, and Object callbacks☆117Updated 7 years ago
- File system minifilter driver for Windows to block symbolic link attacks.☆51Updated 3 years ago
- Use ci.dll API for validating Authenticode signature of files☆129Updated 2 years ago
- An IDA Plugin that help analyzing module that use COM☆198Updated last year
- Multi-purpose proof-of-concept tool based on CPU-Z CVE-2017-15303☆107Updated 6 years ago
- 0CCh Windbg extension: include some useful commands☆109Updated last year
- Three Tiny Examples of Directly Using Vista's NtCreateUserProcess☆85Updated 9 years ago
- Global user-mode hooking framework, based on AppInit_DLLs. The goal is to allow you to rapidly develop hooks to inject in an arbitrary pr…☆161Updated 2 years ago
- PatchGuard Research☆292Updated 6 years ago