xiaolei20190417 Goto Github PK

defenderswitch

Stop Windows Defender using the Win32 API

delete-self-poc

A way to delete a locked file, or current running executable, on disk.

deletefile

Delete file by close all handles in which open it.

deletefilebycreateirp

通过创建Irp删除文件，代码抄袭自某杀毒软件*86部分，因此可以看到IDA痕迹

detours

Detours is a software package for monitoring and instrumenting API calls on Windows. It is distributed in source code form.

dfir-orc

Forensics artefact collection tool for systems running Microsoft Windows

divert

WinDivert: Windows Packet Divert

dokany

User mode file system library for windows with FUSE Wrapper

driverstoreexplorer

Driver Store Explorer [RAPR]

drmemory

Memory Debugger for Windows, Linux, Mac, and Android

edr-testing-script

Test the accuracy of Endpoint Detection and Response (EDR) software with simple script which executes various ATT&CK/LOLBAS/Invoke-CradleCrafter/Invoke-DOSfuscation payloads

elkeid

Elkeid is an open source solution that can meet the security requirements of various workloads such as hosts, containers and K8s, and serverless. It is derived from ByteDance's internal best practices.

extractusnjrnl

Tool to extract the $UsnJrnl from an NTFS volume

fake-everything

Everything的原理猜想与实现

fastfilesearch

Extremely fast file search using the NTFS USN journal

fdlink

File Descriptor Link - recover deleted files that are still opened

filespy

filetest

Source code for File Test - Interactive File System Test Tool

flameshot

Powerful yet simple to use screenshot software :desktop_computer: :camera_flash:

flare-wmi

flat_hash_map

A very fast hashtable

fliesystemfilter

A file system filter, you can do some interesting thing, maybe it's cool.

foks-trot

minifilter双缓冲透明加解密过滤驱动

forcedelete

Windows driver including couple different techniques for file removal when regular operation isn't possible.

fsdefender

Technion CS Ransomware Project: Writing Windows Mini-Filter Driver to protect PC from Ransomware

fsfilter-rs

Experimental: A rust library to monitor filesystem 🪛 and more in windows

fsminfilterhooking

garhal_csgo

A project that demonstrates how to screw with CSGO from Kernel Space. (CSGO Kernel Cheat/Hack) All cleaned up, and with updated offsets.

ghost-in-the-logs

Evade sysmon and windows event logging

golang-open-source-projects

为互联网IT人打造的中文版awesome-go