Alternatives and similar repositories for wevt_template

Users that are interested in wevt_template are comparing it to the libraries listed below

• EricZimmerman / SDB
  Parse Microsoft shim databases
  ☆30Updated 6 months ago
• EricZimmerman / OleCf
  Library to process OLE compound file format. This is a work in progress and was initially written for jumplist parsing (for which it does…
  ☆19Updated 5 months ago
• EricZimmerman / ExtensionBlocks
  Extension blocks as found in ShellBags and other places in the Registry
  ☆24Updated 6 months ago
• libyal / winevt-kb
  Windows Event Log Knowledge Base
  ☆26Updated 9 months ago
• EricZimmerman / RegistryPlugins
  ☆68Updated last week
• msuhanov / ntfs-samples
  NTFS samples
  ☆25Updated 4 years ago
• zodiacon / pstools-rust
  ☆12Updated 4 years ago
• mr-tz / idapython
  IDAPython scripts
  ☆15Updated 7 years ago
• libyal / libscca
  Library and tools to access the Windows Prefetch File (SCCA) format.
  ☆75Updated 6 months ago
• DidierStevens / AnalyzePESig
  ☆18Updated last year
• EricZimmerman / Lnk
  Lnk file parser
  ☆87Updated last month
• airbus-cert / etwbreaker
  An IDA plugin to deal with Event Tracing for Windows (ETW)
  ☆55Updated 3 years ago
• deroko / activationcontext
  ☆15Updated 7 years ago
• repnz / windows-imports-searcher
  Support Windows OS Reversing by searching easily for references to functions across many DLLs
  ☆34Updated 3 years ago
• kobykahane / NpEtw
  Named pipe I/O ETW provider for Windows
  ☆70Updated 4 years ago
• jschicht / EaTools
  Analysis and manipulation of extended attribute ($EA) on NTFS
  ☆38Updated 9 years ago
• EricZimmerman / VSCMount
  Mount VSCs with ease!
  ☆16Updated 5 months ago
• stolenbytes / sxshashing
  ☆18Updated 7 years ago
• WalkingCat / SymDiff
  Diff tool for comparing symbols in PDB files
  ☆83Updated 5 years ago
• AndreyBazhan / DbgPkg
  Scripts to prepare Windows system for debugging.
  ☆30Updated 4 years ago
• ydkhatri / macOS_FE
  Tools for macOS Forensic Bootable media
  ☆15Updated 5 years ago
• assarbad / msvc-undoc
  Undocumented MSVC
  ☆28Updated 11 months ago
• Fleex255 / CustomShim
  Example/starter code for custom Windows application compatibility shims
  ☆33Updated 4 years ago
• m417z / minhook-detours
  A hooking library with a MinHook-like API and a Detours-like implementation, with support for the x86, x64, and ARM64 platforms
  ☆22Updated 3 weeks ago
• epakskape / whpexp
  Experiments involving the Windows Hypervisor Platform
  ☆23Updated 5 years ago
• zodiacon / syllabi
  ☆62Updated last year
• hasherezade / pin_n_sieve
  An experimental dynamic malware unpacker based on Intel Pin and PE-sieve
  ☆60Updated 10 months ago
• WildByDesign / AppContainer-Launcher
  AppContainer and LPAC (Less Privileged AppContainer) Launcher with Capabilities
  ☆59Updated 9 months ago
• Wack0 / DeltaDownloader
  Given delta compressed PE files, find download links for them on the Microsoft Symbol Server. No source PE file or VirusTotal access requ…
  ☆30Updated last year
• sumeshi / mft2es
  A library for fast parse & import of Windows Master File Table($MFT) into Elasticsearch.
  ☆11Updated 3 weeks ago