Satoshi Tanda

HyperPlatform. Intel VT-x based hypervisor aiming to provide a thin VM-exit filtering platform on Windows.

DdiMon. Monitoring and controlling kernel API calls with stealth hook using EPT

Hypervisor-101-in-Rust. The materials of "Hypervisor 101 in Rust", a one-day long course, to quickly learn hardware-assisted virtualization technology and its application for high-performance fuzzing on Intel/AMD processors.

MiniVisorPkg. The research UEFI hypervisor that supports booting an operating system.

SimpleSvm. A minimalistic educational hypervisor for Windows on AMD processors.

SimpleSvmHook. SimpleSvmHook is a research purpose hypervisor for Windows on AMD processors.

barevisor. A bare minimum hypervisor on AMD and Intel processors for learners.

ExploitCapcom. This is a standalone exploit for a vulnerable feature in Capcom.sys

PgResarch. PatchGuard Research

MemoryMon. Detecting execution of kernel memory where is not backed by any image file

DotNetHooking. Sample use cases of the .NET native code hooking technique

scripts_for_RE. Python scripts for reverse engineering.

hvext. The Windbg extensions to study Hyper-V on Intel and AMD processors.

GuardMon. Hypervisor based tool for monitoring system register accesses.

SmmExploit. The report and the exploit of CVE-2021-26943, the kernel-to-SMM local privilege escalation vulnerability in ASUS UX360CA BIOS version 303.

UefiVarMonitor. The runtime DXE driver monitoring access to the UEFI variables by hooking the runtime service table.

WPBT-Builder. The simple UEFI application to create a Windows Platform Binary Table (WPBT) from the UEFI shell.

EopMon. Elevation of privilege detector based on HyperPlatform

findpg. Windbg extension to find PatchGuard pages

WinIoCtlDecoder. IDA Plugin which decodes Windows Device I/O control code into DeviceType, FunctionCode, AccessType and MethodType.

Sushi. a Japanese food keeps you sane

Hello-VT-rp. A simple hypervisor demonstrating the use of the Intel VT-rp (redirect protection) technology.

UEFI-BIOS-Security. Security Camp 2021 & GCC 2022

kraft_dinner. Tool to dump UEFI runtime drivers implementing runtime services for Windows

HelloSmm. This is an instruction to run your own SMM code.

HelloAmdHvPkg. HelloAmdHvPkg is a type-1 research hypervisor for AMD processors.

FU_Hypervisor. A hypervisor hiding user-mode memory using EPT

DebugLogger. A software driver that lets you log kernel-mode debug output into a file on Windows.

CVE-2023-36427. Report and exploit of CVE-2023-36427

Scavenger. A minifilter driver preserves all modified and deleted files.

RemoteWriteMonitor. A tool to help malware analysts tell that the sample is injecting code into other process.

HelloIommuPkg. The sample DXE runtime driver demonstrating how to program DMA remapping.

meow. nyā

DumpVTable. Generates a Python script to give public interface names in an ActiveX file to an IDB file.

DrvLoader. A command line tool to load and unload a device driver.

CVE-2024-21305. Report and exploit of CVE-2024-21305.

CVE-2022-25949. A years-old exploit of a local EoP vulnerability in Kingsoft Antivirus KWatch Driver version 2009.3.17.77.

cs_driver. A sample project for using Capstone from a driver in Visual Studio 2015

CVE-2014-0816. CVE-2014-0816

recon2024_demo. Provides commands to read from and write to arbitrary kernel-mode memory for users with the Administrator privilege. HVCI compatible. No test signing mode is required.

tandasat.github.io. HTML

ProjectLoadTimeMonitor. The Visual Studio extension that measures load time of each project when a solution file is opened.

hyperplatform_log_parser. User-mode program parsing logs created by HyperPlatform

ListWorkItems. Lists work items being queued currently.

CheckSDL. A tool evaluates security configurations of a given PE based on SDL without source code

List-UEFI-Configuration-Tables. List UEFI Configuration Tables

win32_debugout. Shows debug strings on DebubView from an attached process by win32_remote.exe.

DeviceOpener. A command line tool to check if a specified device is accessible.

windbg_init. Windbg Init Script

ScopedResource. Scoped Resource - Generic RAII Wrapper for the Standard Library by Peter Sommerlad and Andrew L. Sandoval

ping_vmm. A user-mode program knocking at HyperPlatform's "backdoor"

ksm. A really simple and lightweight x64 hypervisor written in C for Windows for Intel processors.

minhook. The Minimalistic x86/x64 API Hooking Library for Windows

SecRuntimeSample. A sample usege of SecRuntime.dll on Windows Phone

blog. Ruby

CopyFiles. Copy files onto the IsolatedStorage so that you can download them using IsoStoreSpy.

tandasat.

mylight. Using LED of Samsung Galaxy Ace S5830

shared. Manages files that are shared with multiple boxes.