Windows File System Proxy - FUSE for Windows

State-of-the-art native debugging tools

SoftICE-like kernel debugger for Windows 11

Windows Storage Proxy Driver - User mode disk storage

Research on obfuscated licensing APIs / CLIP service in the Windows kernel

Enumerate user mode shared memory mappings on Windows.

IoCreateDriver Implementation, it can be useful if you're trying to bypass anticheats

A native hypervisor designed for the Windows operating system

🔍 Code to read / write the Process Memory from the Kernel 🔧

Example Windows Kernel-mode Driver which enumerates running processes.

improving zerosums smbdoor - a silent remote backdoor which abuses undoc. APIs in srvnet.sys

A POC for Windows Extension Host hooking

SoftICE-like debugger for Windows 2000 and XP. Archived.

WinPools is an example of how Windows kernel big pool addresses can be leaking using NtQuerySystemInformation

A driver that supports communication between a Windows guest and HyperWin

The project uses SSDT Hooking to bypass security checks during driver loading by hooking NtLoadDriver and modifying the PreviousMode flag.

Kernel-mode research tool that demonstrates how Windows DWM enforces WDA_EXCLUDEFROMCAPTURE by directly calling the undocumented win32kfull!GreProtectSpriteContent function. A proof-of-concept for understanding the user/kernel boundary in screen capture protection mechanisms.

This is the source code for the Linux kernel that runs in Windows Subsystem for Linux 2 (WSL2).

Game Hacking Season 2 has been released. As much as possible, I'd like to make sure that the title is "Windows" The kernel driver implements the maximum implementable functionality. In addition, the IOCTL requester user program can easily request the kernel with just JSON.

windbg plugin easy-step from user code to kernel code