repnz / etw-providers-docs
Document ETW providers
☆216Updated 4 years ago
Alternatives and similar repositories for etw-providers-docs:
Users that are interested in etw-providers-docs are comparing it to the libraries listed below
- Events from all manifest-based and mof-based ETW providers across Windows 10 versions☆279Updated 8 months ago
- View ETW Provider manifest☆447Updated 2 months ago
- KrabsETW provides a modern C++ wrapper and a .NET wrapper around the low-level ETW trace consumption functions.☆621Updated 2 months ago
- Sysmon-Like research tool for ETW☆349Updated 2 years ago
- Run Processes as PPL with ELAM☆154Updated 2 years ago
- A collection of free miscellaneous Windows tools☆128Updated 4 months ago
- Some Code Samples for Windows based Inter-Process-Communication (IPC)☆163Updated 10 months ago
- PoC memory injection detection agent based on ETW, for offensive and defensive research purposes☆259Updated 3 years ago
- Simple project that demonstrates how an ETW consumer can be created just by using NTDLL☆139Updated 5 years ago
- A command tree based on commands and extensions for Windows Kernel Debugging.☆106Updated 4 years ago
- Windows Filtering Platform Explorer☆229Updated 3 months ago
- Source code for File Test - Interactive File System Test Tool☆269Updated 2 weeks ago
- Extended Process Monitor-like tool based on Event Tracing for Windows☆464Updated 5 years ago
- Authenticode Hash Calculator for PE32/PE32+ files☆108Updated 10 months ago
- Event Tracing For Windows (ETW) Resources☆362Updated 3 months ago
- capemon: CAPE's monitor☆106Updated this week
- Named pipe I/O ETW provider for Windows☆69Updated 4 years ago
- C++ Exceptions in Windows Drivers☆203Updated 4 years ago
- Process Monitor X v2☆594Updated 11 months ago
- ☆153Updated 3 months ago
- API Set Viewer☆84Updated 5 years ago
- SysmonX - An Augmented Drop-In Replacement of Sysmon☆212Updated 5 years ago
- An example of a client and server using Windows' ALPC functions to send and receive data.☆90Updated 4 years ago
- This program can retrieve signature information from PE files which signed by one or more certificates on Windows. Supporting multi-signe…☆99Updated 2 years ago
- Security product hook detection☆315Updated 3 years ago
- A DTrace on Windows Reimplementation☆337Updated 2 months ago
- Position Independent Windows Shellcode Written in C☆287Updated 6 years ago
- ☆171Updated 4 years ago
- CallMon is an experimental system call monitoring tool that works on Windows 10 versions 2004+ using PsAltSystemCallHandlers☆129Updated 4 years ago
- Samples for the book Windows Kernel Programming, 2nd edition☆317Updated 3 weeks ago