changeofpace

VivienneVMM. VivienneVMM is a stealthy debugging framework implemented via an Intel VT-x hypervisor.

Self-Remapping-Code. This program remaps its image to prevent the page protection of pages contained in the image from being modified via NtProtectVirtualMemory.

MouClassInputInjection. MouClassInputInjection implements a kernel interface for injecting mouse input data packets into the input data stream of HID USB mouse devices.

MouHidInputHook. MouHidInputHook enables users to filter, modify, and inject mouse input data packets into the input data stream of HID USB mouse devices without modifying the mouse device stacks.

Overwatch-Dump-Fix. x64dbg plugin which removes anti-dumping and obfuscation techniques from the popular FPS game Overwatch.

Force-Page-Protection. This x64dbg plugin sets the page protection for memory mapped views in scenarios which cause NtProtectVirtualMemory to fail.

Hex-Rays-Deep-Compile. Improves Hex-Rays output through batch decompilation.

PE-Header-Dump-Utilities. This x64dbg plugin adds several commands for dumping PE header information by address.

x64dbg-Anti-Debug-POC. viewing page boundaries of pages with PAGE_NOACCESS protection reveals the presence of x64dbg.

Remote-Process-Cookie-for-Windows-7. Obtain remote process cookies by performing a brute-force attack on ntdll.RtlDecodePointer using known pointer encodings.

Simple-Injector. basic dll injector using Qt

Find-Exported-Xrefs. Given a global name in IDA Pro, find all xrefs which are contained in an exported function.

ReClassEx. ReClassEx

Enumerate-GetKeyState-Calls-Using-Varying-nVirtKey. IDAPython script. Bookmark all instances of calls to GetAsyncKeyState and GetKeyState which use a varying value (e.g. not const shift/ctrl/alt modifiers) for the nVirtKey arg.

HyperPlatform. Intel VT-x based hypervisor aiming to provide a thin VM-exit filtering platform on Windows.

cheat-engine. Cheat Engine. A development environment focused on modding

x64dbg. An open-source x64/x32 debugger for windows.