trailofbits / WinDbg-JS
☆24Updated last year
Alternatives and similar repositories for WinDbg-JS:
Users that are interested in WinDbg-JS are comparing it to the libraries listed below
- Extract data of TTD trace file to a minidump☆28Updated last year
- Winbindex bot to pull in binaries for specific releases☆46Updated last year
- A class to emulate the behavior of NtQuerySystemInformation when passed the SystemHypervisorDetailInformation information class☆25Updated last year
- Monitors ETW for security relevant syscalls maintaining the set called by each unique process☆70Updated last year
- ☆29Updated last year
- Repository of Microsoft Driver Block Lists based off of OS-builds☆39Updated 9 months ago
- A Practical example of ELAM (Early Launch Anti-Malware)☆33Updated 3 years ago
- ☆18Updated 3 years ago
- Uses ghidra to find all ETW write metadata for each API in a PE file☆15Updated 6 months ago
- Clone running process with ZwCreateProcess☆58Updated 4 years ago
- Command like tool to print mitigation flags for running processes in a memory dump☆47Updated 4 years ago
- C# implementation to produce ROR-13 numeric hash for given function API name☆31Updated 5 years ago
- Former Multi - Ring to Kernel To UserMode Transitional Shellcode For Remote Kernel Exploits☆28Updated 2 years ago
- A small tool to unmap PE memory dumps.☆11Updated last year
- Small tool to play with IOCs caused by Imageload events☆42Updated last year
- Enabled / Disable LSA Protection via BYOVD☆65Updated 3 years ago
- ☆29Updated last month
- Inter-Process Communication Mechanisms☆26Updated 4 years ago
- Convert Microsoft Defender Antivirus Signatures (VDM) into YARA rules☆36Updated this week
- Read ETW Provider events. Inspired by ETWExplorer by Pavel Yosifovich☆14Updated 7 months ago
- HEVD Exploit: BufferOverflowNonPagedPoolNx on Windows 10 22H2 - Escalating from Low Integrity to SYSTEM via Aligned Chunk Confusion☆46Updated last week
- ☆84Updated 7 months ago
- Windows kernel PDB data parsed into YAML☆34Updated 2 months ago
- ☆31Updated 4 years ago
- A fast method to intercept syscalls from any user-mode process using InstrumentationCallback and detect any process using Instrumentation…☆26Updated last year
- Progress of learning kernel development☆14Updated 2 years ago
- Manually perform syscalls without going through any external API or DLL.☆17Updated last year
- really ?☆12Updated 11 months ago
- A few examples of how to trap virtual memory access on Windows.☆18Updated last month
- List the ETW provider(s) in the registration table of a process.☆53Updated last year