Skip to content
#

wdfilter

Star

Here are 2 public repositories matching this topic...

wesmar / ForceIO

Star 13

ForceIO: Standalone no-CRT C tool for minifilter-bypass file operations (delete/move/copy) on Windows 11. Routes kernel I/O below WdFilter.sys via WHCP-signed IObitUnlocker.sys. Atomic ephemeral SCM sessions, FDI/LZX in-memory decompression from application icon, build-time PE overlay checksum bypass. Full RE writeup with source and binaries

reverse-engineering windows-kernel infosec kernel-driver ioctl file-operations security-research windows-defender deviceiocontrol windows-11 no-crt byovd signed-driver scm-service minifilter-bypass wdfilter whcp pe-checksum driver-validation cabinet-api
  • Updated Jun 25, 2026
  • C

Avagodo / wdfilter-research

Star 6

Reverse engineering and Reconstruction of Microsoft Defender's WdFilter.sys for Windows minifilter callbacks, registry monitoring, process tracking, DLP, and hardening.

c pdb static-analysis reverse-engineering windows-kernel file-system antivirus codeview decompilation dlp windows-driver security-research windows-defender minifilter kernel-internals microsoft-defender tamper-protection wdfilter driver-reconstruction defender-internals
  • Updated Oct 6, 2026
  • C

Add this topic to your repo

To associate your repository with the wdfilter topic, visit your repo's landing page and select "manage topics."

Learn more