DownWithUp
Follow
-
ALPC-Example Public
An example of a client and server using Windows' ALPC functions to send and receive data.
-
mkit Public
Simple file hiding kernel rootkit for Linux v6
-
-
WarbirdExamples Public
An example of how to use Microsoft Windows Warbird technology
-
HyperCalc Public
An Intel HAXM powered, protected mode, 32 bit, hypervisor addition calculator, written in Rust.
-
SystemsWork Public
A repo containing examples relating to various aspects of Windows internals and processor features
-
KLoad Public
A simple command line utility to quickly load and unload Windows drivers
-
KLoad_C Public archive
A simple command line utility to quickly load and unload Windows drivers
-
WhoCalls_C Public archive
WhoCalls can query a directory of files, find the binaries, and search for a user specified Win API import. It and works with both 32-bit (PE) and 64-bit (PE32+) file formats (.exe, .dll, .sys)
-
WhoCalls Public
A program which can query a directory of files, find the binaries, and search for a specified Win API import.
-
WHPHook Public
Simple DLL and client app that work together to hook all the functions in WinHvPlatform.dll in order to provide logging and introspection at the hypervisor level
-
-
speakeasy Public
Forked from mandiant/speakeasyWindows kernel and user mode emulation.
-
windbg2ida Public
Forked from SinaKarvandi/windbg2idaWindbg2ida lets you dump each step in Windbg then shows these steps in IDA
-
CallMon Public
CallMon is an experimental system call monitoring tool that works on Windows 10 versions 2004+ using PsAltSystemCallHandlers
-
CVE-Stockpile Public
Master list of all my vulnerability discoveries. Mostly 3rd party kernel drivers.
-
bswap Public
A Windbg extension for swapping byte endianness.
-
DynamicKernelShellcode Public
An example of how x64 kernel shellcode can dynamically find and use APIs
-
FakeDriverPoC Public
This is a PoC driver which creates a fake driver and device object with the intent on allowing a user mode program to communicate with a "fake" driver and device.
-
SHA-ME Public
A pure WinAPI program that demonstrates translating a file into a SHA-256 hash. Designed to be used as a utility.
-
Spoof-Task-Manager Public
An example showing how a mutex can stop taskmgr.exe from loading
-
-
WinPools Public
WinPools is an example of how Windows kernel big pool addresses can be leaking using NtQuerySystemInformation
-
The-Good-Bad-Code Public
Pushing the limits of bad programming practices. Abusing APIs. Destroying utility programs.
-
-
Driver-Easy-Research Public
Python scripts for manipulating Driver Easy's servers
-
CVE-2018-16712 Public
PoC Code for CVE-2018-16712 (exploit by MmMapIoSpace)
-
CVE-2018-18714 Public
PoC Code for CVE-2018-18714 (exploit by stack overflow)
-
CVE-2018-18026 Public
PoC Code for CVE-2018-18026 (exploit by stack overflow)
-
CVE-2018-16713 Public
PoC code for CVE-2018-16713 (exploit by rdmsr)