noheart2019 Goto Github PK

anti-hook-

awesome-virtualization

Collection of resources about Virtualization

awesome-windows-kernel-security-development

binary-security-tutorial

Resource assembly of 'Binary Security Tutorial' online course of mine. Video link：https://pan.baidu.com/s/1ltcHIehhLFVFMvru6tGQ8A Passwd：axje

capstone

Capstone disassembly/disassembler framework: Core (Arm, Arm64, M68K, Mips, PPC, Sparc, SystemZ, X86, X86_64, XCore) + bindings (Python, Java, Ocaml)

cpu-internals

Intel / AMD CPU Internals

detours

Detours is a software package for monitoring and instrumenting API calls on Windows. It is distributed in source code form.

drivertutorial

eopmon

Elevation of privilege detector based on HyperPlatform

findwdk

CMake module for building drivers with Windows Development Kit (WDK)

first

学习GIT使用

foks-trot

It's a minifilter used for transparent-encrypting.

hookmsrbysvm

hook msr by amd svm

hyperplatform

Intel VT-x based hypervisor aiming to provide a thin VM-exit filtering platform on Windows.

hyperplatform_log_parser

User-mode program parsing logs created by HyperPlatform

hypervisor-from-scratch

Source code of a multiple series of tutorials about hypervisor. Available at:

ia32-doc

IA32-doc is a project which aims to put as many definitions from the Intel Manual into machine-processable format as possible

kvm-guest-drivers-windows

Windows paravirtualized

linux_kernel_debug_disassemble_ida_vmware

Helper script for Linux kernel disassemble or debugging with IDA Pro on VMware + GDB stub (including some symbols helpers)

more

TLB splitting VMM

notebook

Running notes in Wiki - concepts, commands, code snippets.

peviewer

Simple PEviewer

powershell

PowerShell functions and scripts (SCCM, SCSM, AD, Exchange, O365, ...)

processinjection

Some ways to inject a DLL into a alive process

procmonx

Extended Process Monitor-like tool based on Event Tracing for Windows

ransomwaredetector

securityplus

simplevisor

SimpleVisor is a simple, portable, Intel VT-x hypervisor with two specific goals: using the least amount of assembly code (10 lines), and having the smallest amount of VMX-related code to support dynamic hyperjacking and unhyperjacking (that is, virtualizing the host state from within the host). It works on Windows and UEFI.

sysmon-config

Sysmon configuration file template with default high-quality event tracing

sysmon_reverse