Pavel Yosifovich

WindowsInternals. Windows Internals Book 7th edition Tools

TotalRegistry. Total Registry - enhanced Registry editor/viewer

AllTools. All reasonably stable tools

SystemExplorer. Windows System Explorer

windowskernelprogrammingbook. The Windows Kernel Programming book samples

ProcMonXv2. Process Monitor X v2

EtwExplorer. View ETW Provider manifest

ProcMonX. Extended Process Monitor-like tool based on Event Tracing for Windows

PEExplorerV2. Portable Executable Explorer version 2

Win10SysProgBookSamples. Windows 10 System Programming book samples

windowskernelprogrammingbook2e. Samples for the book Windows Kernel Programming, 2nd edition

DriverMon. Monitor activity of any driver

WFPExplorer. Windows Filtering Platform Explorer

ObjectExplorer. Explore Kernel Objects on Windows

TotalPE2. PE Viewer

WinSpy. Enhanced version of the classic Spy++ tool

QuickAsm. Simple x86/x64 Assembler/Disassembler/Emulator

PEExplorer. Portable Executable Explorer

sysrun. Run any executable as SYSTEM account (no service required)

TotalPE. Yet another PE Viewer

RunAppContainer. Run executables in an AppContainer

PoolMonXv2. Kernel Pool Monitor

PoolMonX. A GUI version of the classic PoolMon tool

rust-course.

CLRExplorer. Explore .NET Processes and Dump files

WinDbgX. An attempt to create a friendly version of WinDbg

PdbView. PdbView shows the contents of PDB files

ApiSetView. API Set Viewer

GflagsX. Enhanced version of the GFlags tool

DllInjectionWithThreadContext. This is a sample that shows how to leverage SetThreadContext for DLL injection

ALPCLogger. Log ALPC activity

JobExplorer. Explore Job Objects on a Windows system

winnativeapibooksamples. Samples from my book Windows Native API programming

WinSys. C++ library for low-level Windows development

PoolMonXv3. Monitor Kernel pool allocations tags

Recon2023. Recon 2023 slides and code

DbgPrint. Debug Print viewer (user and kernel)

ProcExpX. C++

KernelObjectView. View handles and object for each object type

syllabi.

DeviceExplorer. C++

WTLHelper. WTL helper library

youtubecode. Youtube channel sample code

TraceConnections. Simple example for getting started with eBPF for Windows

VerifierDLL. Example of building an application verifer DLL

WinEventHooks. SetWinEventHook Sample

TotalSystem. View Windows System in action

BITSManager. BITS Transfers Manager

eBPFStudio. Work with eBPF on Windows

PerfMonX. PerfMonX is an enhanced Performance Monitor tool

DotNetExp. C++

CPUStress. CPU Stress v3.0

InfStudio. INF Studio for easier working with driver installation files

ObjMgrProjFS. Projected File System Sample (Object Manager Namespace)

RemoteThreadDetection. Remote Thread Detection with a Kernel Driver

ManagedWindows. Managed wrappers around the Windows API and some Native API

BgInfo. BgInfo is a WPF variant on the Sysinternals BgInfo tool.

KObjects. Sample for Creating a new kernel object type and supporting API

MalDevWorkshopWebinar. Demo from the Malware Analysis and Development Webinar