hfiref0x Goto Github PK

al-khaser

(This is a fork used primarily to submit patches into upstream repository) Public malware techniques used in the wild: Virtual Machine, Emulation, Debuggers, Sandbox detection.

ar4ffc

Archive repository for fast fact-checks

asio3unlock

ASUSTeK AsIO3 I/O driver unlock

authhashcalc

Authenticode Hash Calculator for PE32/PE32+ files

bsodscreen

BSOD Screensaver

cve-2015-1701

Win32k LPE vulnerability used in APT attack

dsefix

Windows x64 Driver Signature Enforcement Overrider

hfiref0x.github.io

kdu

Kernel Driver Utility

lightftp

Small x86-32/x64 FTP Server

lightftp_win

misc

Miscellaneous Code and Docs

mpenum

Enumerate Windows Defender threat families and dump their names according category

ntcall64

Windows NT x64 syscall fuzzer

pdbex

(This is a fork used primarily to submit patches into upstream repository) pdbex is a utility for reconstructing structures and unions from the PDB into compilable C headers

rocall

ReactOS x86-32 syscall fuzzer

rpcview

(This is a fork used primarily to submit patches into upstream repository) RpcView is a free tool to explore and decompile Microsoft RPC interfaces

stryker

Multi-purpose proof-of-concept tool based on CPU-Z CVE-2017-15303

sxsexp

Expand compressed files from WinSxS folder

syscalltables

Windows NT x64 Syscall tables

tdl

Driver loader for bypassing Windows x64 Driver Signature Enforcement

uacme

Defeating Windows User Account Control

upgdsed

Universal PatchGuard and Driver Signature Enforcement Disable

vault

Various code from the past (for historical purposes)

vboxhardenedloader

VirtualBox VM detection mitigation loader

vmde

Source from VMDE paper, adapted to 2015

wdextract

Extract Windows Defender database from vdm files and unpack it

winobjex64

Windows Object Explorer 64-bit

wubbaboomark

Debugger Anti-Detection Benchmark

zeroaccess

ZeroAccess v3 toolkit