Kelvin

kHypervisor. kHypervisor is a lightweight bluepill-like nested VMM for Windows, it provides and emulating a basic function of Intel VT-x

ThreadSpy. C++

DeviceMon. VT-based PCI device monitor (SPI)

NoTruth. C++

PerfMon. first commit

Notes. Open Course for diving security internal

UsbMon. C

ScreenCapAttack. C

TechMyths.

Perfvisor. init

SyncJobs_MPSystem. C++

Common. First commit

DebugLogger. A software driver that lets you log kernel-mode debug output into a file on Windows.

NestedHypervisor. PHP

r0ak. r0ak ("roak") is the Ring 0 Army Knife -- A Command Line Utility To Read/Write/Execute Ring Zero on for Windows 10 Systems

WindowsDbgViewFixed.

Simpleator. Simpleator ("Simple-ator") is an innovative Windows-centric x64 user-mode application emulator that leverages several new features that were added in Windows 10 Spring Update (1803), also called "Redstone 4", with additional improvements that were made in Windows 10 October Update (1809), aka "Redstone 5".

processor-trace. libipt - an Intel(R) Processor Trace decoder library

SimpleSvm. A minimalistic educational hypervisor for Windows on AMD processors.

sdk-api. Public contributions for win32 API documentation

windows-driver-docs-ddi. The official Windows Driver Kit DDI reference documentation sources

LDasm. Lightweight x86 and x64 instructions disassembler

UEFI-Bootkit. A small bootkit which does not rely on x64 assembly.

VisualUefi. A project for allowing EDK-II Development with Visual Studio

windows-driver-docs. The official Windows Driver Kit documentation sources

MemoryMon. Detecting execution of kernel memory where is not backed by any image file

GuardMon. Hypervisor based tool for monitoring system register accesses.

HyperPlatform. Intel VT-x based hypervisor aiming to provide a thin VM-exit filtering platform on Windows.

linux. Linux kernel source tree

microsoft-pdb. Information from Microsoft about the PDB format. We'll try to keep this up to date. Just trying to help the CLANG/LLVM community get onto Windows.