zodiacon / EtwExplorer
View ETW Provider manifest
☆455Updated 3 months ago
Alternatives and similar repositories for EtwExplorer:
Users that are interested in EtwExplorer are comparing it to the libraries listed below
- Events from all manifest-based and mof-based ETW providers across Windows 10 versions☆286Updated 9 months ago
- Sysmon-Like research tool for ETW☆350Updated 2 years ago
- Document ETW providers☆217Updated 4 years ago
- KrabsETW provides a modern C++ wrapper and a .NET wrapper around the low-level ETW trace consumption functions.☆633Updated 2 weeks ago
- Event Tracing For Windows (ETW) Resources☆362Updated 4 months ago
- RPC Monitor tool based on Event Tracing for Windows☆338Updated 6 months ago
- ☆752Updated last year
- My personal cheat sheet for using WinDbg for kernel debugging☆405Updated 4 months ago
- Windows 10 System Programming book samples☆415Updated 8 months ago
- Process Monitor X v2☆598Updated last year
- Useful scripts for WinDbg using the debugger data model☆402Updated 10 months ago
- Moneta is a live usermode memory analysis tool for Windows with the capability to detect malware IOCs☆731Updated 11 months ago
- Expriments☆451Updated 4 months ago
- RpcView is a free tool to explore and decompile Microsoft RPC interfaces☆953Updated last year
- Samples for the book Windows Kernel Programming, 2nd edition☆323Updated 2 months ago
- A collection of free miscellaneous Windows tools☆130Updated 6 months ago
- Extract Windows Defender database from vdm files and unpack it☆435Updated 5 years ago
- XNTSV program for detailed viewing of system structures for Windows.☆456Updated this week
- Pinjectra is a C/C++ OOP-like library that implements Process Injection techniques (with focus on Windows 10 64-bit)☆801Updated 2 years ago
- This is a repo for small, useful scripts and extensions☆243Updated last year
- Source code for File Test - Interactive File System Test Tool☆277Updated 3 weeks ago
- PoC memory injection detection agent based on ETW, for offensive and defensive research purposes☆264Updated 3 years ago
- Enumerate and disable common sources of telemetry used by AV/EDR.☆780Updated 3 years ago
- awesome windbg extensions☆323Updated 5 years ago
- Run Processes as PPL with ELAM☆153Updated 2 years ago
- Windows Filtering Platform Explorer☆239Updated 3 weeks ago
- ☆294Updated 3 years ago
- Windows System Explorer☆843Updated 8 months ago
- A DTrace on Windows Reimplementation☆338Updated 2 weeks ago
- Enumerating and removing kernel callbacks using signed vulnerable drivers☆548Updated 2 years ago