repnz / etw-providers-docs
Document ETW providers
☆217Updated 4 years ago
Alternatives and similar repositories for etw-providers-docs:
Users that are interested in etw-providers-docs are comparing it to the libraries listed below
- Events from all manifest-based and mof-based ETW providers across Windows 10 versions☆286Updated 9 months ago
- View ETW Provider manifest☆455Updated 3 months ago
- KrabsETW provides a modern C++ wrapper and a .NET wrapper around the low-level ETW trace consumption functions.☆633Updated 2 weeks ago
- Sysmon-Like research tool for ETW☆350Updated 2 years ago
- Run Processes as PPL with ELAM☆153Updated 2 years ago
- Some Code Samples for Windows based Inter-Process-Communication (IPC)☆166Updated 11 months ago
- A collection of free miscellaneous Windows tools☆130Updated 6 months ago
- Source code for File Test - Interactive File System Test Tool☆277Updated 3 weeks ago
- PoC memory injection detection agent based on ETW, for offensive and defensive research purposes☆264Updated 3 years ago
- Simple project that demonstrates how an ETW consumer can be created just by using NTDLL☆139Updated 5 years ago
- Windows Filtering Platform Explorer☆239Updated 3 weeks ago
- An example of a client and server using Windows' ALPC functions to send and receive data.☆94Updated last month
- ☆172Updated 4 years ago
- Samples for the book Windows Kernel Programming, 2nd edition☆323Updated 2 months ago
- This program can retrieve signature information from PE files which signed by one or more certificates on Windows. Supporting multi-signe…☆99Updated 2 years ago
- Process Monitor X v2☆598Updated last year
- RPC Monitor tool based on Event Tracing for Windows☆338Updated 6 months ago
- Named pipe I/O ETW provider for Windows☆69Updated 4 years ago
- API Set Viewer☆86Updated last month
- PE Viewer☆165Updated last month
- Authenticode Hash Calculator for PE32/PE32+ files☆107Updated 11 months ago
- This is a collection of interesting codes about Windows Process creation.☆232Updated last year
- APC Internals Research Code☆161Updated 4 years ago
- C++ Exceptions in Windows Drivers☆204Updated 4 years ago
- Detours with just single dependency - NTDLL☆617Updated 2 years ago
- Research on Windows Kernel Executive Callback Objects☆284Updated 4 years ago
- ☆157Updated 4 months ago
- ETWProcessMon2 is for Monitoring Process/Thread/Memory/Imageloads/TCPIP via ETW + Detection for Remote-Thread-Injection & Payload Detecti…☆298Updated 11 months ago
- A DTrace on Windows Reimplementation☆338Updated 2 weeks ago
- Monitor activity of any driver☆334Updated 4 years ago