Windows paravirtualized drivers for QEMU\KVM

EDR Lab for Experimentation Purposes

Writing & Making Operating System and Kernel parts so simple like Hello World Programs, Starting from writing Bootloaders, Hello World Kernel, GDT, IDT, Terminal, Keyboard/Mouse, Memory Manager, HDD ATA R/W, VGA/VESA Graphics

Linux kernel driver for Wacom devices

A basic Direct Kernel Object Manipulation rootkit that removes a process from the EPROCESS list, hiding it from the Task Manager

protector & obfuscator & code virtualizer

kernel mode anti cheat

Sanctum is an experimental proof-of-concept EDR, designed to detect modern malware techniques, above and beyond the capabilities of antivirus. Built in Rust.

C++ STL in the Windows Kernel with C++ Exception Support

The goal of the tool is to monitor requests received by selected device objects or kernel drivers. The tool is quite similar to IrpTracker but has several enhancements. It supports 64-bit versions of Windows (no inline hooks are used, only moodifications to driver object structures are performed) and monitors IRP, FastIo, AddDevice, DriverUnload and StartIo requests.

致敬锐速 - 记住要猛哦～

Simple Intel CPU processor tracing on Linux

This repository is a journey through Operating System concepts, with practical implementations in C. Each day focuses on a specific topic, providing theoretical understanding and hands-on coding experience.

DR.CHECKER : A Soundy Vulnerability Detection Tool for Linux Kernel Drivers

CMake module for building drivers with Windows Development Kit (WDK)

RedSails is a Python based post-exploitation project aimed at bypassing host based security monitoring and logging. DerbyCon 2017 Talk: https://www.youtube.com/watch?v=Ul8uPvlOsug

DragonBurn is CS2(Counter-Strike 2 cheat) kernel-mode read-only external cheat. Undetected by all anti-cheats except Faceit.

A curated compilation of extensive resources dedicated to bootkit and rootkit development.

C/C++ Runtime library for system file (Windows Kernel Driver) - Supports Microsoft STL

Windows x64 kernel mode rootkit process hollowing POC.

A Hyper-V Hacking Framework For Windows 10 x64 (AMD & Intel)

Tutorial & a blog post that demonstrate how to code a Windows driver to inject a custom DLL into all running processes. I coded it from start to finish using C++ and x86/x64 Assembly language in Microsoft Visual Studio. The solution includes a kernel driver project, a DLL project and a C++ test console project.

Basic interactive Windows kernel offensive toolkit written in C

Access Arm64 CPU system registers

Android aarch64 kernel driver module providing efficient memory operations, touch simulation and IPC. Features include fast memory remapping.

Use ntdll/ntoskrnl to implement Kernel32, Advapi32 and other APIs. It includes user-mode and kernel-mode.

🔍 Code to read / write the Process Memory from the Kernel 🔧

Windows UEFI Bootkit

Windows Kernel Driver Development in C# with Windows Driver Kit (WDK)

Some usefull info when reverse engineering Kernel Mode Anti-Cheat