[Deprecated, work in progress alternative: https://github.com/M2Team/NanaRun] Series of System Administration Tools

Dump lsass using only NTAPI functions by hand-crafting Minidump files (without MiniDumpWriteDump!!!)

Dump lsass using only NTAPI functions creating 3 JSON and 1 ZIP file... and generate the MiniDump file later!

Go shellcode loader that combines multiple evasion techniques

Extract the SAM and SYSTEM hives using the Volume Shadow Copy (VSS) API. With exfiltration and XOR obfuscation options. Implemented in C#, C++, Crystal and Python

Bypass Credential Guard by patching WDigest.dll using only NTAPI functions

Shellcode loader written in C and Assembly utilizing direct or indirect syscalls to evade UM EDR hooks

Some random system tools for Windows

Impersonate Tokens using only NTAPI functions

Windows Rregistry Linking Utility

Vulnerable (on purpose) programs to leak NtReadVirtualMemory address for stealthier API resolution (no GetProcAddress, GetModuleHandle or LoadLibrary in the IAT)

「⚙️」Detect which native Windows API's (NtAPI) are being hooked

Remap ntdll.dll using only NTAPI functions with a suspended process

Windows API (WinAPI) functions and system calls with categories in JSON format, including arguments (SAL notation) and more.

Codes that could trigger BSOD (Blue Screen of Death) on Windows.

KNSoft.NDK provides native C/C++ definitions and import libraries for Windows NT.

💠 Documented and undocumented WinAPI search.

Disclosing information from an AppContainer.

Microsoft Windows user-mode API access with clean Rust types.

Samples that shows how to use API Hook libraries: Detours, Deviare, MHook, EasyHook to hide files with the "+/*.txt" file name pattern.

Windows malware development C/C++ snippets.

Header‑only C++ library for Native API syscall invocation on x64 Windows

Windows Hacks by Windows Programmer

obfuscate WINAPI/NTAPI calls easily.

A golang wrapper for Napatech's API - Allows packet capture directly into go applications with the use of NTPL filters.

A dedicated repository for exploring offensive kernel-mode techniques.

🛠️ Invoke Windows Native API syscalls directly with Syscaller, a header-only C++ library that ensures compatibility and avoids breaking updates.

C++ Usermode Windows Driver Scanner To Enumerate Loaded Kernel Modules And Driver Objects, Flagging, Suspicious or manually mapped drivers.

Windows syscall dumper that extracts syscall IDs and addresses from ntdll.dll.

A simple C# Application to check for all active handles to a specified process using NtQuerySystemInformation