sgabe / SymlinkProtect
File system minifilter driver for Windows to block symbolic link attacks.
☆51Updated 3 years ago
Related projects: ⓘ
- Documenting system information classes and their uses☆48Updated 2 years ago
- ☆56Updated 2 years ago
- Retrieve pointers to undocumented kernel functions and offsets to members within undocumented structures to use in your driver by using t…☆52Updated 5 years ago
- Resolve DOS MZ executable symbols at runtime☆93Updated 2 years ago
- arbitrary kernel read/write in dbutil_2_3.sys, Proof of Concept Local Privilege Escalation to nt authority/system☆52Updated 2 years ago
- D☆36Updated 3 years ago
- An example of how x64 kernel shellcode can dynamically find and use APIs☆103Updated 4 years ago
- An example of a client and server using Windows' ALPC functions to send and receive data.☆88Updated 4 years ago
- Reimplement CreateProcessInternalW via Windows 10 20H1+/Windows 11 Base on NtCreateUserProcess-Post☆46Updated 2 weeks ago
- ☆64Updated 3 years ago
- ☆17Updated 3 years ago
- A driver that hooks C: volume using symbolic link callback to track all FS access to the volume☆100Updated 4 years ago
- A collection of tools, source code, and papers researching Windows' implementation of CET.☆72Updated 3 years ago
- An automatic tool for fixing dumped PE files☆42Updated 4 years ago
- View handles and object for each object type☆61Updated 5 years ago
- Inject unsigned DLL into Protected Process Light (PPL)☆12Updated last year
- Simple project that demonstrates how an ETW consumer can be created just by using NTDLL☆129Updated 5 years ago
- IOCTLpus can be used to make DeviceIoControl requests with arbitrary inputs (with functionality somewhat similar to Burp Repeater).☆81Updated 2 years ago
- c++ implementation of windows heavens gate☆54Updated 3 years ago
- This is a simple driver with x64 inline assembly☆52Updated 4 years ago
- Helper script for Windows kernel debugging with IDA Pro on VMware + GDB stub (including PDB symbols)☆57Updated last year
- Driver and WinDBG scripts to dump information about all resources and lookaside lists☆63Updated 4 years ago
- Local OXID Resolver (LCLOR) : Research and Tooling☆31Updated 3 years ago
- Command like tool to print mitigation flags for running processes in a memory dump☆41Updated 4 years ago
- Hook all callbacks which are registered with LdrRegisterDllNotification☆79Updated last year
- ☆24Updated 3 years ago
- Helper idapython code for reversing kmdf drivers☆68Updated 2 years ago
- codes for my blog post: https://secrary.com/Random/InstrumentationCallback/☆165Updated 6 years ago
- ☆26Updated 6 years ago
- Three Tiny Examples of Directly Using Vista's NtCreateUserProcess☆84Updated 8 years ago