changeofpace

redasm. The OpenSource Disassembler

open-gpu-doc. Documentation of NVIDIA chip/hardware interfaces

InfinityHook. Hook system calls, context switches, page faults and more.

govmm. Virtual Machine Manager for Go (govmm) is a suite of packages that provide Go APIs for creating and managing virtual machines.

openenclave. SDK for developing enclaves

calculator. Windows Calculator: A simple yet powerful calculator that ships with Windows

MS-DOS. The original sources of MS-DOS 1.25, 2.0, and 4.0 for reference purposes

ghidra. Ghidra is a software reverse engineering (SRE) framework

clusterfuzz. Scalable fuzzing infrastructure.

DIE. Dynamic IDA Enrichment

windbg_js_scripts. Toy scripts for playing with WinDbg JS API

kHypervisor. kHypervisor is a lightweight bluepill-like nested VMM for Windows, it provides and emulating a basic function of Intel VT-x

applepie. A hypervisor for fuzzing built with WHVP and Bochs

barf-project. BARF : A multiplatform open source Binary Analysis and Reverse engineering Framework

Windows-Kernel-Explorer. A free but powerful Windows kernel research tool.

upx. UPX - the Ultimate Packer for eXecutables

ReClass.NET. More than a ReClass port to the .NET platform.

apitrace. Tools for tracing OpenGL, Direct3D, and other graphics APIs

Hypervisor-From-Scratch. Source code of a multiple series of tutorials about the hypervisor. Available at: https://rayanfam.com/tutorials

Simpleator. Simpleator ("Simple-ator") is an innovative Windows-centric x64 user-mode application emulator that leverages several new features that were added in Windows 10 Spring Update (1803), also called "Redstone 4", with additional improvements that were made in Windows 10 October Update (1809), aka "Redstone 5".

KdExploitMe. A kernel driver to practice writing exploits against, as well as some example exploits using public techniques.

HexRaysDeob. Hex-Rays microcode API plugin for breaking an obfuscating compiler

cpu_features. A cross platform C99 library to get cpu features at runtime.

DebugViewPP. DebugView++, collects, views, filters your application logs, and highlights information that is important to you!

al-khaser. Public malware techniques used in the wild: Virtual Machine, Emulation, Debuggers, Sandbox detection.

edk2. EDK II

awesome-virtualization. Collection of resources about Virtualization

hvpp. hvpp is a lightweight Intel x64/VT-x hypervisor written in C++ focused primarily on virtualization of already running operating system

avmext. Anti-Anti-VM solution via Windows Driver

ia32-doc. IA32-doc is a project which aims to put as many definitions from the Intel Manual into machine-processable format as possible

DirectXTK. The DirectX Tool Kit (aka DirectXTK) is a collection of helper classes for writing DirectX 11.x code in C++

pdbex. pdbex is a utility for reconstructing structures and unions from the PDB into compilable C headers

awesome-windows-kernel-security-development. windows kernel security development

devilution. Diablo devolved - magic behind the 1996 computer game

SigMaker-x64. IDA Pro 7 and up compatible SigMaker plugin

PowerShell. PowerShell for every system!

meltdown. This repository contains several applications, demonstrating the Meltdown bug.

pdfs. Technically-oriented PDF Collection (Papers, Specs, Decks, Manuals, etc)

debugging-stories. A collection of debugging stories. PRs welcome (sorry for the backlog) :-)

ntkernel-error-category. A C++ 11 std::error_category for the NT kernel's NTSTATUS error codes

keystone. Keystone assembler framework: Core (Arm, Arm64, Hexagon, Mips, PowerPC, Sparc, SystemZ & X86) + bindings

EopMon. Elevation of privilege detector based on HyperPlatform

MemoryMon. Detecting execution of kernel memory where is not backed by any image file

GuardMon. Hypervisor based tool for monitoring system register accesses.

HyperPlatform. Intel VT-x based hypervisor aiming to provide a thin VM-exit filtering platform on Windows.

sysinternals-source. HTML

Captain-Hook.

atom-bombing. Brand New Code Injection for Windows

SimpleVisor. SimpleVisor is a simple, portable, Intel VT-x hypervisor with two specific goals: using the least amount of assembly code (10 lines), and having the smallest amount of VMX-related code to support dynamic hyperjacking and unhyperjacking (that is, virtualizing the host state from within the host). It works on Windows and UEFI.

malSploitBase. Malware exploits

UniversalInject. Windows IME-based DLL injection. Able to inject a DLL without OpenProcess or a process handle being necessary..

rop_compiler. An open source, multi-architecture ROP compiler written in python

cuckoo. Cuckoo Sandbox is an automated dynamic malware analysis system

rekall. Rekall Memory Forensic Framework

DdiMon. Monitoring and controlling kernel API calls with stealth hook using EPT

volatility. An advanced memory forensics framework

rootkit.com. Mirror of users section of rootkit.com

libsplice. Library for kernel and user mode splicing for Windows (x86 and x64).

DSEFix. Windows x64 Driver Signature Enforcement Overrider

Windbg2Struct. Takes a Windbg dumped structure (using the 'dt' command) and formats it into a C structure

windbg_to_c. Translates WinDbg "dt" structure dump to a C structure

USN-Journal-Parser. Python script to parse the NTFS USN Journal

pefile. pefile is a Python module to read and work with PE (Portable Executable) files

hexrays_tools. C++

systeminformer. A free, powerful, multi-purpose tool that helps you monitor system resources, debug software and detect malware. Brought to you by Winsider Seminars & Solutions, Inc. @ https://windows-internals.com

PESecurity. PowerShell module to check if a Windows binary (EXE/DLL) has been compiled with ASLR, DEP, SafeSEH, StrongNaming, and Authenticode.

UPGDSED. Universal PatchGuard and Driver Signature Enforcement Disable

ransomware_begone. ransomware_begone

microsoft-pdb. Information from Microsoft about the PDB format. We'll try to keep this up to date. Just trying to help the CLANG/LLVM community get onto Windows.

binnavi. BinNavi is a binary analysis IDE that allows to inspect, navigate, edit and annotate control flow graphs and call graphs of disassembled code.

rewolf-pcausa-exploit. PCAUSA Rawether for Windows Local Privilege Escalation

vmw_vmx_overloader. Loading unsigned code into kernel in Windows 10 (64) with help of VMware Workstation Pro/Player design flaw

Ponce. IDA 2016 plugin contest winner! Symbolic Execution just one-click away!

REtypedef. Name substitution plugin for IDA Pro

zydis. Fast and lightweight x86/x86-64 disassembler and code generation library

Nanomite. Graphical Debugger for x64 and x86 on Windows

IDASkins. Advanced skinning plugin for IDA Pro

cheat-engine. Cheat Engine. A development environment focused on modding

lighthouse. A Coverage Explorer for Reverse Engineers

RePEconstruct. Python

ProcessHider. Post-exploitation tool for hiding processes from monitoring applications

I-know-where-your-page-lives. I Know Where Your Page Lives: Derandomizing the latest Windows 10 Kernel - ZeroNights 2016

binexport. Export disassemblies into Protocol Buffers

IDA_Extrapass. IDA ExtraPass PlugIn

cappsule-hypervisor. C

WindowsIntelPT. This driver implements the Intel Processor Trace functionality in Intel Skylake architecture for Microsoft Windows

VMAttack. VMAttack PlugIn for IDA Pro

GleeBug. Debugging Framework for Windows.

debug-recipes. My notes on software troubleshooting, covering debugging and tracing techniques and tools. Available at wtrace.net.

windbg-extensions. Various extensions for WinDbg

meow. nyā

WingDbg. Friends don't let friends debug alone

pwntools. CTF framework and exploit development library

write-ups-2016. Wiki-like CTF write-ups repository, maintained by the community. 2016

Pillow. Python Imaging Library (fork)

QtSettings. Automated settings dialog.

ScyllaHide. C++

QtPlugin. Plugin demonstrating how to link with Qt. CURRENTLY OUTDATED, UPDATE SOON

malware_analysis. Various snippets created during malware analysis

pics. File formats dissections and more...

pocs. Proof of Concepts (PE, PDF...)

capstone. Capstone disassembly/disassembler framework for ARM, ARM64 (ARMv8), Alpha, BPF, Ethereum VM, HPPA, LoongArch, M68K, M680X, Mips, MOS65XX, PPC, RISC-V(rv32G/rv64G), SH, Sparc, SystemZ, TMS320C64X, TriCore, Webassembly, XCore and X86.

VirtualDbg. Test code only. Not reliable for actual use.

VirtualDbgHide. Test code only. Not suitable for actual use.

PgResarch. PatchGuard Research

Windows-driver-samples. This repo contains driver samples prepared for use with Microsoft Visual Studio and the Windows Driver Kit (WDK). It contains both Universal Windows Driver and desktop-only driver samples.

HexRaysCodeXplorer. Hex-Rays Decompiler plugin for better code navigation

x64dbg. An open-source user mode debugger for Windows. Optimized for reverse engineering and malware analysis.