awesome-windows-kernel-security-development

• awesome-windows-kernel-security-development
  • powershell
  • pe file format
  • asm ide
  • meltdown/spectre poc
  • lightweight c++ gui library
  • direct ui
  • chrome
  • chrome Extension
  • cef
  • WebBrowser
  • d3d
  • opencv
  • bass
  • lua
  • c++ 11/14/17/20
  • cmake
  • DesignPattern
  • c++ & js
  • gdi/gdi+
  • QT
  • computer vision & machine learning
  • compress
  • Dongle
  • spy++
  • Shell Extension for Windows Explorer
  • windows system programming
  • etw
  • wsl/unix
  • device tree
  • irp monitor
  • nt crucial modules
  • windows kernel driver
  • windows kernel driver with c++ runtime
  • blackbone
  • hidinput
  • dkom
  • ssdt hook
  • eat/iat/object/irp/iat hook
  • InfinityHook
  • inline hook
  • hook engine
  • anti hook
  • inject technique (ring0)
  • inject technique (ring3)
  • WoW64 <-> x64
  • anti autorun
  • anti dll inject
  • load Dll from memory
  • Unpack dll load in runtime
  • dll hijack
  • com hijack
  • anti dll hijack
  • process hollowing
  • pe loader
  • memory pe dumper
  • dll map detection
  • dll to shellcode
  • dll to exe
  • hide process
  • hide & delete dll
  • load driver from memory
  • bypass memory scanner
  • KeUserModeCallBack
  • callback
  • keyboard filter
  • usb filter
  • sfilter
  • minifilter
  • anti Ransomware
  • virtual disk
  • virtual file system
  • lpc
  • alpc
  • lsp/spi
  • afd
  • tdi
  • wfp
  • ndis
  • game accelerator
  • wsk
  • rootkits
  • mbr
  • bootkits
  • uefi/smm
  • bootloader
  • smc
  • anti debug
  • crypters
  • malware
  • EternalBlue && Doublepulsar && Mine
  • shellcode analysis
  • malware analysis
  • av evasion
  • arktools
  • EDR
  • bypass patchguard
  • bypass dse
  • HackSysExtremeVulnerableDriver
  • windows exploits
  • linux exploits
  • windows kernel exploits
  • race condition
  • LPE
  • linux exploit
  • office exploit
  • flash exploit
  • sandbox
  • sandbox escape
  • anti exploit
  • cve
  • hips
  • windows hypervisor
  • kvm
  • vt
  • firmware
  • fuzzer
  • fuzz
  • emet
  • hotpatch
  • memory hack
  • game
  • game network accelerator
  • game hack
  • anti cheat
  • software reverse
  • pe protector
  • unpacker
  • emulate code execution
  • pin
  • symbolic execution
  • obfuscation
  • deobfuscation
  • taint analyse
  • bin diff
  • debugger
  • x64dbg plugin
  • live kernel debug
  • windbg plugin
  • virtualkd
  • ida plugin
  • ida sig maker
  • idapython
  • pykd
  • rpc
  • hash dump
  • auxiliary lib
  • ring3 nt api
  • winpcap
  • metasploit
  • shellcode generator
  • shellcode encoder
  • shadow
  • network lib
  • http
  • https proxy
  • sock proxy
  • reverse proxy
  • mitm
  • ssl
  • json
  • serialization
  • awesome
  • windows Driver Kit ddi (device driver interface) documentation
  • windbg preview
  • anti-anti-vm
  • vm
  • pe tool
  • tools
  • post-exploitation
  • nsa security tools
  • apt
  • 3rd party library
  • adblock
  • bypass uac
  • miscellaneous
  • slides
  • blogs
  • sec tools
  • waf
  • web security research site
  • development documents
  • browser automated test
  • docker
  • leaked source code
  • sspi
  • openssl
  • pdb
  • gpu
  • crypto api
  • ipc
  • iot sec
  • ascii banner
  • book code
  • regex
  • paper
  • ebook
  • ctf
  • pentest
  • wpad/pac
  • js obfuscator/deobfuscator
  • js reverse engine
  • decompiler
  • software collections

powershell

• github.com/rootclay/Powershell-Attack-Guide

pe file format

• github.com/corkami/pics

asm ide

• github.com/ThomasJaeger/VisualMASM
• github.com/Dman95/SASM
• github.com/mrfearless/UASM-with-RadASM

meltdown/spectre poc

• github.com/turbo/KPTI-PoC-Collection
• github.com/gkaindl/meltdown-poc
• github.com/feruxmax/meltdown
• github.com/Eugnis/spectre-attack

lightweight c++ gui library

• github.com/Xoliper/ANGE
• github.com/iUIShop/LibUIDK (mfc skin ui)
• github.com/zlgopen/awtk
• github.com/idea4good/GuiLite
• github.com/golang-ui/nuklear
• github.com/Dovyski/cvui
• github.com/andlabs/libui
• github.com/hasaranga/RFC-Framework
• github.com/dustpg/LongUI
• github.com/bognikol/Eleusis

direct ui

• github.com/caozhiyi/DuiLib_c
• www.skinui.cn/
• www.showdoc.cc/skinui?page_id=135303
• help.5yyz.com/665984
• github.com/SOUI2/soui
• github.com/netease-im/NIM_Duilib_Framework
• github.com/gclxry/EasyDuilib
• github.com/v-star0719/MFC_LogicalWnd
• github.com/duzhi5368/FKDuiLibEditor
• github.com/wanttobeno/bkuilib
• github.com/wanttobeno/XSkin1.0
• github.com/idea4good/GuiLite
• github.com/redrains/DuiLib_Redrain
• github.com/wanttobeno/UIDesigner
• github.com/zhongyang219/TrafficMonitor
• github.com/wanttobeno/Duilib_Extension
• github.com/zhongyang219/MusicPlayer2
• github.com/nmgwddj/duilib_tutorial
• github.com/redrains/DuiLib_Redrain
• github.com/nmgwddj/InstallAssist
• github.com/netease-im/NIM_PC_UIKit
• github.com/nmgwddj/Optimizer
• github.com/nmgwddj/BarPCMaster (netbar)

chrome

• github.com/shuax/GreenChrome

chrome Extension

• github.com/Tuhinshubhra/ExtAnalysis

cef

• github.com/JelinYao/MyChrome
• github.com/fanfeilong/cefutil
• github.com/acristoffers/CEF3SimpleSample
• github.com/sanwer/Browser

WebBrowser

• github.com/zhichao281/duilib-MiniBlinkBrowser
• github.com/litehtml/litebrowser
• github.com/venam/Browser (lib)
• github.com/wanttobeno/Study_IWebBrowser2

d3d

• github.com/QianMo/Direct3D-Win32-Book-Src-Code
• github.com/MKXJun/DirectX11-With-Windows-SDK
• github.com/ThirteenAG/d3d9-wrapper

opencv

• github.com/JimmyHHua/opencv_tutorials

bass

• github.com/r10s/BASS_VST

lua

• github.com/vinniefalco/LuaBridge

c++ 11/14/17/20

• github.com/0voice/cpp_new_features
• github.com/akkaze/ThreadPool
• github.com/xiaoweiChen/CPP-Concurrency-In-Action-2ed-2019
• github.com/xiaoweiChen/CPP-17-STL-cookbook
• github.com/changkun/modern-cpp-tutorial

cmake

• github.com/xiaoweiChen/CMake-Cookbook

DesignPattern

• design-patterns.readthedocs.io/zh_CN/latest/index.html
• github.com/Waleon/DesignPatterns
• github.com/GoodmanTao/DesignPatternInC

c++ & js

• github.com/xhawk18/promise-cpp
• github.com/panopticoncentral/jsrt-wrappers
• github.com/wargio/WSH-Framework
• github.com/ExpLife0011/WebBrowser
• github.com/wanttobeno/Study_mujs

gdi/gdi+

• www.mctrl.org/ (win32 control lib)
• github.com/wanttobeno/AlphaEditor
• github.com/wanttobeno/FastZoomDemo (zoom)
• github.com/wanttobeno/GdiPlusTextEffect
• github.com/wanttobeno/GdiPlusString
• github.com/wanttobeno/WindowFinder
• github.com/wanttobeno/ymagine
• github.com/wanttobeno/levels-adjustment
• github.com/wanttobeno/ElipsePic
• github.com/wanttobeno/windows-effect
• github.com/wanttobeno/Study_easing_animation
• github.com/wanttobeno/Study_FindPicAlgorithm (find picture algorithm)
• github.com/wanttobeno/Window_GlassIntro_demo

QT

• github.com/ShowFL/Toou-2D
• github.com/jaredtao/TaoQuick
• github.com/feiyangqingyun/qucsdk
• github.com/feiyangqingyun/QWidgetDemo
• github.com/feiyangqingyun/qtkaifajingyan
• github.com/feiyangqingyun/QWidgetExe

computer vision & machine learning

• github.com/wanttobeno/sod

compress

• github.com/wanttobeno/snappy

Dongle

• github.com/wanttobeno/Dongle

spy++

• github.com/wjx0912/MySpy

Shell Extension for Windows Explorer

• github.com/derceg/explorerplusplus
• github.com/XhmikosR/perfmonbar (perfmonbar)
• github.com/abhimanyusirohi/ThumbFish (nice demo)
• github.com/matssigge/JASE
• github.com/Oeffner/MtzExtInfoTip
• github.com/danielgrigg/ContextMenuDemo
• github.com/monolithpl/stexbar
• github.com/CaSchmidt/csMenu
• github.com/blndev/ExplorerUtilitys
• github.com/pke/Windows-Explorer-OSGi-Shell-Extensions
• github.com/Anton-V-K/MultiThumbExtension
• github.com/0ffffffffh/ffmpegShellExtension
• github.com/Ralph-Lee/WinShellExt
• github.com/slivermeteor/LockKeys
• github.com/alexandermenze/ShellExtensionInfoTip
• github.com/jbrandwood/EditWith
• github.com/calzakk/CyoHash
• github.com/asa75asa/ImageResizer
• github.com/tillig/JunctionShellExtensions
• github.com/keybase/KBShellExt
• github.com/T800G/StatusBar7
• github.com/vladm3/ShellExtension
• github.com/sop/cygextreg
• github.com/AndreasVerhoeven/HTMLPreviewShellExtension
• github.com/alvinhochun/KritaShellExtension
• github.com/AUTOMATIC1111/3ds-shell
• github.com/google/google-drive-shell-extension
• github.com/TortoiseGit/TortoiseGit
• github.com/sanje2v/MantaPropertyExtension
• github.com/phwitti/cmdhere

windows system programming

• github.com/dengqizhou30/AIAssistC
• github.com/solemnwarning/rehex (hex editor)
• github.com/progmboy/openprocmon (procmon)
• github.com/ezrealik/AI-Icarus (AI iflytek SDK)
• rufus.ie/ (Create bootable USB drives the easy way)
• github.com/emmanuel-marty/em_inflate (Fast, small, in-memory inflate (zlib, deflate and gzip decompression))
• github.com/skadro-official/skCrypter (string crypt)
• github.com/hynninen/win-pbkdf2
• github.com/K0rz3n/PatchesTester (check system patch info)
• github.com/nccgroup/WindowsJobLock (Windows Process Lockdown Tool using Job Objects)
• github.com/long123king/TokenInsight
• github.com/btbd/access (Access without a real handle)
• github.com/CoatiSoftware/Sourcetrail (Source code explorer)
• github.com/DoubleLabyrinth/WindowsSudo
• github.com/AzureGreen/NetView
• github.com/MFCer/AutoUpdate
• github.com/ufrisk/LeechCore (Physical Memory Acquisition Library)
• github.com/marcosd4h/sysmonx
• github.com/Dankirk/RegSLScan
• github.com/nogginware/mstscdump
• github.com/zodiacon/ApiSetView
• github.com/DOGSHITD/SciDetectorApp (SCI)
• github.com/DOGSHITD/AcpiTool (ACPI)
• github.com/VertexToEdge/WindowFunctionTracer
• github.com/sganis/golddrive
• github.com/yanncam/exe2powershell
• github.com/owodelta/coilgun (Direct API Calling)
• github.com/NYAN-x-CAT/Disable-Windows-Defender
• github.com/d35ha/CallObfuscator
• github.com/zodiacon/RegEditX
• github.com/ZhanLang/jcfs (everything)
• github.com/ZhanLang/msdk (sdk)
• github.com/MiroKaku/ConMon
• github.com/SinaKarvandi/Process-Magics
• github.com/LoukaMB/ExceptionSupervisor
• github.com/zmrbak/PcWeChatHooK
• github.com/not-matthias/Nemesis (process dumper)
• github.com/QAX-A-Team/EventCleaner
• github.com/BlackINT3/none (common lib)
• github.com/77Sera/BrowserSecurity
• github.com/amitwaisel/Malproxy (Proxy system calls over an RPC channel)
• github.com/jnastarot/soul_eater (it can extract functions from .dll, .exe, .sys)
• github.com/mtth-bfft/lsobj
• github.com/mtth-bfft/ntsec
• github.com/fritzone/obfy
• github.com/microsoft/NetworkDirect
• github.com/jay/gethooks
• github.com/laxodev/RAII-WINAPI-Memory-Manager
• github.com/hfiref0x/WDExtract
• github.com/binbibi/libedge
• github.com/bb107/WinSudo
• github.com/can1357/WinFaults
• github.com/Silica/sandbox
• github.com/horsicq/Nauz-File-Detector
• github.com/horsicq/xntsv (nt struct)
• github.com/jnastarot/shibari (pe+)
• github.com/NoMoreFood/WinPriv
• github.com/yejiansnake/windows-sys-base
• github.com/lifenjoiner/pacdbger
• github.com/lifenjoiner/sendto-plus
• github.com/billziss-gh/winspd
• github.com/ffiirree/Capturer
• github.com/Claybird/lhaforge
• github.com/jjzhang166/nargnos-WindowsUtil
• github.com/cool2528/baiduCDP
• github.com/anhkgg/SuperWeChatPC
• github.com/Alex3434/GetHDDSerial
• github.com/TonyChen56/HackerTools
• github.com/libyal/liblnk
• github.com/NtRaiseHardError/Kaiser
• github.com/mengskysama/V8 (chrome v8 engine)
• github.com/locustwei/WorkBack
• github.com/360-A-Team/EventCleaner
• github.com/Microsoft/Windows-classic-samples
• github.com/troldal/OpenXLSX (.xlsx format)
• github.com/mity/windrawlib (GDI+ Helper)
• github.com/henrypp/errorlookup
• github.com/longmode/authzsec-mod-um (AppContainer and ACL)
• github.com/henrypp/memreduct
• github.com/thomaslaurenson/LiveDiff (live diff)
• github.com/thomaslaurenson/CellXML-offreg (hive file parse)
• github.com/zhaolong/libparser (static lib parse)
• github.com/WildByDesign/Privexec
• github.com/KangLin/RabbitIm
• github.com/kingsunc/MiniDump
• github.com/amdf/reparselib
• github.com/Zero3K/connectfusion (download manager)
• github.com/Zero3K/ERAM (RAM Disk)
• github.com/bailey27/cppcryptfs ( gocryptfs encrypted overlay filesystem)
• github.com/etsubu/MacroRecorder (recording keyboard and mouse macros)
• github.com/wyrover/CodeLib
• github.com/Rprop/CppDLL (dll to .h and lib)
• github.com/seledka/syslib
• github.com/leecher1337/regremap
• github.com/webees/ADkiller
• github.com/skysilent/coroutine_study (fiber)
• github.com/ruusty/NAntMenu
• github.com/chrdavis/PIFShellExtensions
• github.com/codepongo/zshellext
• github.com/lz77win/lz77win_sources
• github.com/Microsoft/perfview
• github.com/GameTechDev/PresentMon
• github.com/hfiref0x/BSODScreen
• github.com/CasualX/LibEx
• github.com/syhyz1990/baiduyun
• github.com/WalkingCat/SymDiff
• github.com/libyal/libevtx
• github.com/wanttobeno/Screenshot
• github.com/scarsty/tinypot
• github.com/jonasblunck/DynHook
• github.com/y11en/PEBFake (PEB fake)
• github.com/wanttobeno/mousehook (setwindowhook)
• github.com/wanttobeno/DXF-Viewer
• github.com/wanttobeno/XmlConfigDemo
• github.com/wanttobeno/GeneralHashFunctions
• github.com/wanttobeno/Chrome-base-cpu
• github.com/wanttobeno/stl_util
• github.com/wanttobeno/LinkHelper
• github.com/wanttobeno/Ring3GetProcessInfo
• github.com/zsummer/breeze
• github.com/wanttobeno/SoftWareManager
• github.com/wanttobeno/GetMacAddress
• github.com/wanttobeno/HtmlViewer
• github.com/wanttobeno/AltServer
• github.com/wanttobeno/GetPeInfo
• github.com/wanttobeno/notepad
• github.com/wanttobeno/PELearningMaterials
• github.com/wanttobeno/Detours_4.0.1
• github.com/wanttobeno/skinsb
• github.com/wanttobeno/DLib-Attacher
• github.com/wanttobeno/VmpHandle
• github.com/wanttobeno/ScopeGuard (resource safe delete)
• github.com/wanttobeno/HashMapDemo
• github.com/wanttobeno/nanob (protobuf)
• github.com/wanttobeno/baidu-sofa-pbrpc-win (protobuf)
• github.com/xlet/UpdateClient
• github.com/wanttobeno/AesFileProtection
• github.com/wanttobeno/IeProxy
• github.com/wanttobeno/MyProtocol
• github.com/wanttobeno/Window_KeyAndMouseHook
• github.com/wanttobeno/doublebufferedqueue (double buffered queue)
• github.com/DoubleLabyrinth/010Editor-keygen (keygen)
• github.com/wanttobeno/Cpp11ThreadPool
• github.com/wanttobeno/Study_shellcode (shellcode)
• github.com/wanttobeno/Study_algorithm (data struct)
• github.com/wanttobeno/ThreadPool
• github.com/wanttobeno/Study_threadpool (thread pool)
• github.com/wanttobeno/Study_Websocket (websocket)
• github.com/Amanieu/asyncplusplus
• github.com/wanttobeno/Study_Socket
• github.com/wanttobeno/DllProtect
• github.com/allenyllee/The-CPUID-Explorer
• github.com/wanttobeno/SunDaySearchSignCode
• github.com/wanttobeno/x64_AOB_Search (fast search memory algorithm)
• github.com/wanttobeno/iQIYI_Web_Video_Upload (http simulate upload)
• github.com/wanttobeno/Study_XiaoMi_Login (https simulate login)
• github.com/fawdlstty/NetToolbox
• github.com/hzqst/FuckCertVerifyTimeValidity
• github.com/717021/PCMgr (task manager)
• github.com/silverf0x/RpcView (rpc)
• github.com/ez8-co/unlocker ()
• github.com/nkga/self-updater (framework for secure self-update)
• github.com/liamkirton/sslcat (nc with ssl)
• github.com/Seineruo/RSA-Tool
• github.com/PBfordev/wxAutoExcel
• github.com/ax330d/Symex
• github.com/Biswa96/PDBDownloader
• github.com/Biswa96/TraceEvent
• github.com/hfiref0x/Misc
• github.com/SergioCalderonR/DelSvc
• github.com/wyrover/win-privileges-examples (DACL)
• github.com/nccgroup/WindowsDACLEnumProject (DACL)
• github.com/xqymain/ServerLocker
• github.com/wanttobeno/SunDaySearchSignCode (fast search memory)
• github.com/zhongyang219/SimpleNotePad
• github.com/zhongyang219/TrafficMonitor
• github.com/codereba/data_scrambler (scrambler)
• github.com/3gstudent/Catch-specified-file-s-handle (enum file handle)
• github.com/intel/safestringlib
• github.com/eyusoft/asutlity
• github.com/ThomasThelen/BrowserLib
• github.com/OSRDrivers/dirchange
• github.com/OSRDrivers/deleteex (FileDispositionInfoEx)
• github.com/notscimmy/YASS (sig scanner)
• github.com/942860759/BrowserHistory
• github.com/NoMoreFood/putty-cac
• github.com/NoMoreFood/Repacls
• github.com/NoMoreFood/WinPriv
• github.com/NoMoreFood/Crypture
• github.com/Microsoft/winfile
• github.com/mullvad/windows-libraries
• github.com/wjcsharp/wintools
• github.com/nmgwddj/logs-monitor
• github.com/nmgwddj/TaskbarTool
• github.com/nmgwddj/DevCon
• github.com/nmgwddj/SystemProcessInfo
• github.com/nmgwddj/ServiceMgr

etw

• github.com/pierricgimmig/orbitprofiler

wsl/unix

• github.com/Mermeze/wslam (wsl anti malware)
• github.com/Biswa96/WSLInstall
• github.com/Biswa96/WslReverse
• github.com/Biswa96/XConPty
• github.com/mintty/wsltty.appx

device tree

• github.com/MartinDrab/VrtuleTree

irp monitor

• github.com/MartinDrab/IRPMon

nt crucial modules

• github.com/MeeSong/Nt-Crucial-Modules

windows kernel driver

• github.com/kkent030315/anycall (x64 Windows kernel code execution via user-mode, arbitrary syscall, vulnerable IOCTLs demonstration)
• github.com/yardenshafir/DpcWait (DPC)
• github.com/can1357/NtLua (Lua in kernel)
• github.com/mrexodia/NtPhp (Php in kernel)
• github.com/DownWithUp/CallMon
• github.com/BadPlayer555/KernelGDIDraw (GDI)
• github.com/alxbrn/km-um-communication
• github.com/DavidXanatos/IgnoreACLs
• github.com/hfiref0x/KDU (Kernel Driver Utility)
• github.com/zhuhuibeishadiao/JunkDriveOpenSource
• github.com/dearfuture/DriverTutorial
• github.com/G4rb3n/Windows-Driver
• github.com/btbd/wpp (Intercepting DeviceControl via WPP)
• github.com/maharmstone/smbfs (SMB filesystem driver for Windows)
• github.com/maharmstone/btrfs (Windows driver for the next-generation Linux filesystem Btrfs)
• github.com/zodiacon/windowskernelprogrammingbook (sample)
• github.com/0xcpu/ExecutiveCallbackObjects
• github.com/alxbrn/r6s-external-nuklear-socket
• github.com/vmcall/dxgkrnl_hook
• github.com/alxbrn/kdmapper-1803-1903
• github.com/juniorjacob/readwrite-kernel-stable
• github.com/mstefanowich/IsFileSigned
• github.com/apriorit/antirootkit-anti-splicer
• github.com/Mouka-Yang/KernelDriverDemo
• github.com/tomLadder/WinLib
• github.com/coltonon/MoaRpm
• github.com/wanttobeno/ProcessManager_Ring0
• github.com/wanttobeno/Win_Driver_Mouse_And_Key
• github.com/wanttobeno/Win64DriverStudy_Src
• github.com/tdevuser/MalwFinder
• github.com/Sqdwr/WriteFile_IRP
• github.com/nmgwddj/learn-windows-drivers
• github.com/mq1n/EasyRing0

windows kernel driver with c++ runtime

• github.com/MiroKaku/ucxxrt (R3 / R0 C++ Runtime Lib)
• github.com/jxy-s/stlkrn (C++ STL in the Windows Kernel with C++ Exception Support)
• github.com/r1cky33/kernel_gdi_renderer
• github.com/haram/kernel_library
• github.com/avakar/vcrtl
• github.com/ZhanLang/msddk
• github.com/DragonQuestHero/Kernel-Force-Delete (force delete file)
• github.com/MeeSong/WDKExt
• github.com/HoShiMin/Kernel-Bridge (power)
• github.com/wjcsharp/Common
• github.com/ExpLife/DriverSTL
• github.com/sysprogs/BazisLib
• github.com/AmrThabet/winSRDF
• github.com/sidyhe/dxx
• github.com/zer0mem/libc
• github.com/eladraz/XDK
• github.com/vic4key/Cat-Driver
• github.com/AndrewGaspar/km-stl
• github.com/zer0mem/KernelProject
• github.com/zer0mem/miniCommon
• github.com/jackqk/mystudy
• github.com/yogendersolanki91/Kernel-Driver-Example

blackbone

• github.com/AbinMM/MemDllLoader_Blackbone
• github.com/hzqst/unicorn_pe
• github.com/nofvcks/AimKit-Pasted-Driver
• github.com/alexpsp00/x-elite-loader
• github.com/DarthTon/Xenos
• github.com/DarthTon/Blackbone

hidinput

• github.com/changeofpace/MouHidInputHook
• github.com/hawku/TabletDriver
• github.com/ViGEm/HidGuardian
• github.com/ecologylab/EcoTUIODriver
• github.com/djpnewton/vmulti
• github.com/duzhi5368/FKHIDKeyboardSimTest (support usb)
• github.com/Jehoash/WinIO3.0

dkom

• github.com/alal4465/Win_Rootkit (Kernel RAT X86)
• github.com/waryas/EUPMAccess
• github.com/notscimmy/pplib
• blog.csdn.net/zhuhuibeishadiao/article/details/51136650 (get process full path name)
• bbs.pediy.com/thread-96427.htm (modify process image name)
• github.com/ZhuHuiBeiShaDiao/PathModification
• github.com/ZhuHuiBeiShaDiao/NewHideDriverEx
• github.com/Sqdwr/HideDriver
• github.com/nbqofficial/HideDriver
• github.com/landhb/HideProcess
• github.com/tfairane/DKOM

ssdt hook

• github.com/crvvdev/MasterHide (x64)
• github.com/iPower/KasperskyHook
• github.com/Sqdwr/64-bits-inserthook
• github.com/int0/ProcessIsolator
• github.com/mrexodia/TitanHide (x64dbg Plugin)-(DragonQuestHero Suggest)
• github.com/papadp/shd
• github.com/bronzeMe/SSDT_Hook_x64
• github.com/s18leoare/Hackshield-Driver-Bypass
• github.com/sincoder/hidedir
• github.com/wyrover/HKkernelDbg
• github.com/CherryZY/Process_Protect_Module
• github.com/weixu8/RegistryMonitor
• github.com/nmgwddj/Learn-Windows-Drivers

eat/iat/object/irp/iat hook

• github.com/jguo52/IOCTL-hook
• github.com/hugsy/CFB (Irp Hook)
• github.com/Rat431/ColdKernel_KUSER
• github.com/hasherezade/IAT_patcher
• github.com/Cyrex1337/hook.lib
• github.com/hMihaiDavid/hooks
• github.com/Scorbutics/IATHook
• github.com/amazadota/AFD-HOOK-
• github.com/wyyqyl/HookIAT
• github.com/smore007/remote-iat-hook
• github.com/m0n0ph1/IAT-Hooking-Revisited
• github.com/xiaomagexiao/GameDll
• github.com/HollyDi/Ring0Hook
• github.com/mgeeky/prc_xchk
• github.com/tinysec/iathook

InfinityHook

• github.com/FiYHer/InfinityHookPro
• github.com/huoji120/MakeInfinityHookGreatAgain
• github.com/p4xon/SyscallHook
• yanjuan.xyz/2019/08/syscallhook/
• github.com/huoji120/huoji_debuger
• github.com/everdox/InfinityHook

inline hook

• github.com/adrianyy/kernelhook
• github.com/gfreivasc/VMTHook
• github.com/zhipeng515/MemberFunctionHook （member function hook）
• github.com/windy32/win32-console-hook-lib
• github.com/M0rtale/Universal-WndProc-Hook
• github.com/a7031x/HookApi
• github.com/blaquee/APCHook
• github.com/simonberson/ChromeURLSniffer
• github.com/codereversing/sehveh_hook
• github.com/Matviy/LeagueReplayHook
• github.com/jonasblunck/DP
• github.com/XBased/xhook
• github.com/rokups/hooker
• github.com/Ayuto/DynamicHooks
• github.com/sincoder/wow64hook
• github.com/strobejb/sslhook
• github.com/petrgeorgievsky/gtaRenderHook
• github.com/WopsS/RenHook
• github.com/chinatiny/InlineHookLib (R3 & R0)
• github.com/tongzeyu/HookSysenter
• github.com/idkwim/frookSINATRA (x64 sysenter hook)
• github.com/VideoCardGuy/HideProcessInTaskmgr
• github.com/MalwareTech/FstHook
• github.com/Menooker/FishHook
• github.com/G-E-N-E-S-I-S/latebros
• bbs.pediy.com/thread-214582.htm

hook engine

• github.com/nektra/Deviare-InProc
• github.com/btbd/smap
• github.com/gdabah/distormx
• github.com/danielkrupinski/vac-hooks
• github.com/vol4ok/libsplice (r3 & r0)
• github.com/HoShiMin/HookLib (r3 & r0)
• github.com/Rebzzel/kiero (d3d hook)
• github.com/aschrein/apiparse
• github.com/zyantific/zyan-hook-engine
• github.com/jonasblunck/DP (com hook)
• github.com/jonasblunck/DynHook
• github.com/wanttobeno/ADE32_InlineHook
• github.com/coltonon/RegHookEx (mid function)
• github.com/Synestraa/ArchUltimate.HookLib
• github.com/DominicTobias/detourxs
• github.com/Ilyatk/HookEngine
• github.com/zyantific/zyan-hook-engine
• github.com/martona/mhook
• github.com/EasyHook/EasyHook
• github.com/RelicOfTesla/Detours
• github.com/stevemk14ebr/PolyHook
• github.com/TsudaKageyu/minhook
• github.com/Microsoft/Detours
• github.com/Microwave89/ntapihook

anti hook

• github.com/outflanknl/Dumpert
• github.com/nickcano/ReloadLibrary

inject technique (ring0)

• github.com/SDXT/MMInject (Kernel DLL Injector using NX Bit Swapping and VAD hide for hiding injected DLL)
• github.com/Vicshann/GInjer
• github.com/r1cky33/Basic-GUI-Loader
• github.com/alxbrn/kernel-injector
• github.com/btbd/modmap
• github.com/Mecanik/MecanikProcessBreaker
• github.com/mactec0/Kernelmode-manual-mapping-through-IAT
• github.com/adrianyy/KeInject
• github.com/Sqdwr/LoadImageInject
• github.com/haidragon/NewInjectDrv
• github.com/alex9191/Kernel-dll-injector (DllInjectFromKernel)
• github.com/wbenny/keinject (ApcInjectFromKernel)
• github.com/repnz/apc-research (APC)

inject technique (ring3)

• github.com/Broihon/GH-Injector-Library
• github.com/antonioCoco/Mapping-Injection (MapViewOfFile2)
• github.com/theevilbit/injection
• github.com/SafeBreach-Labs/pinjectra
• github.com/odzhan/injection
• github.com/M-r-J-o-h-n/SWH-Injector
• github.com/nccgroup/ncloader (A session-0 capable dll injection utility)
• github.com/vmcall/eye_mapper (BattlEye x64 usermode injector)
• github.com/Shaxzy/VibranceInjector
• github.com/xiaobo93/UnModule_shellcode_Inject
• github.com/Cybellum/DoubleAgent
• github.com/realoriginal/reflective-rewrite (InjectFromMemory)
• github.com/blaquee/APCHook (apc inject)
• github.com/secrary/InjectProc
• github.com/ez8-co/yapi (Yet Another Process Injector)
• github.com/UserExistsError/InjectDll (InjectFromMemory)
• github.com/notscimmy/libinject
• github.com/BorjaMerino/tlsInjector (tls)
• github.com/BorjaMerino/Pazuzu (InjectFromMemory)
• github.com/strobejb/injdll
• github.com/strivexjun/DriverInjectDll (MapInjectDll)
• github.com/sud0loo/ProcessInjection
• github.com/apriorit/SvcHostDemo
• github.com/can1357/ThePerfectInjector
• github.com/VideoCardGuy/X64Injector
• github.com/papadp/reflective-injection-detection (InjectFromMemory)
• github.com/psmitty7373/eif (InjectFromMemory)
• github.com/rokups/ReflectiveLdr (InjectFromMemory)
• github.com/BenjaminSoelberg/ReflectivePELoader (InjectFromMemory)
• github.com/NtRaiseHardError/Phage (InjectFromMemory)
• github.com/dismantl/ImprovedReflectiveDLLInjection (InjectFromMemory)
• github.com/CylanceVulnResearch/ReflectiveDLLRefresher (InjectFromMemory)
• github.com/amishsecurity/paythepony (InjectFromMemory)
• github.com/deroko/activationcontexthook
• github.com/ez8-co/yapi (Cross x86 & x64 injection)
• github.com/georgenicolaou/HeavenInjector
• github.com/tinysec/runwithdll
• github.com/NtOpcode/NT-APC-Injector
• github.com/caidongyun/WinCodeInjection
• github.com/countercept/doublepulsar-usermode-injector
• github.com/mq1n/DLLThreadInjectionDetector
• github.com/hkhk366/Memory_Codes_Injection
• github.com/chango77747/ShellCodeInjector_MsBuild
• github.com/Zer0Mem0ry/ManualMap
• github.com/secrary/InfectPE
• github.com/zodiacon/DllInjectionWithThreadContext
• github.com/NtOpcode/RtlCreateUserThread-DLL-Injection
• github.com/hasherezade/chimera_loader
• github.com/Ciantic/RemoteThreader
• github.com/OlSut/Kinject-x64
• github.com/tandasat/RemoteWriteMonitor
• github.com/stormshield/Beholder-Win32
• github.com/secrary/InjectProc
• github.com/AzureGreen/InjectCollection
• github.com/uItra/Injectora
• github.com/rootm0s/Injectors
• github.com/Spajed/processrefund
• github.com/al-homedawy/InjecTOR
• github.com/OlSut/Kinject-x64
• github.com/stormshield/Beholder-Win32
• github.com/yifiHeaven/MagicWall

WoW64 <-> x64

• github.com/wolk-1024/WoW64Utils
• github.com/dadas190/Heavens-Gate-2.0
• github.com/leecher1337/ntvdmx64
• github.com/hyzhangzhy/WindowX
• github.com/georgenicolaou/HeavenInjector
• github.com/georgenicolaou/W64oWoW64
• github.com/Rprop/X86Call
• github.com/rwfpl/rewolf-wow64ext
• github.com/ovidiuvio/libntdbg
• github.com/haidragon/x86tox64
• github.com/3gstudent/CreateRemoteThread
• github.com/RaMMicHaeL/Textify

anti autorun

• github.com/analyst004/autorun

anti dll inject

• 0cch.com/2015/04/10/e998b2e6ada2global-windows-hookse6b3a8e585a5e79a84e4b880e4b8aae696b9e6b395/ (global hook)
• blog.csdn.net/songjinshi/article/details/7808561 (message hook)
• blog.csdn.net/songjinshi/article/details/7808624 (message hook)
• github.com/mq1n/DLLThreadInjectionDetector
• github.com/analyst004/antinject
• github.com/ExpLife/BotKiller

load Dll from memory

• github.com/hasherezade/module_overloading
• github.com/UserExistsError/DllLoaderShellcode
• github.com/jnastarot/native_peloader
• github.com/fancycode/MemoryModule
• github.com/strivexjun/MemoryModulePP

Unpack dll load in runtime

• github.com/1ce0ear/DllLoaderUnpacker

dll hijack

• github.com/itm4n/CDPSvcDllHijacking
• github.com/Cybereason/siofra (identify and exploit)
• github.com/anhkgg/SuperDllHijack
• github.com/strivexjun/AheadLib-x86-x64
• github.com/zeffy/proxydll_template

com hijack

• github.com/leoloobeek/COMProxy
• github.com/enigma0x3/MessageBox

anti dll hijack

• github.com/fortiguard-lion/anti-dll-hijacking

process hollowing

• github.com/xfgryujk/InjectExe
• github.com/m0n0ph1/Basic-File-Crypter
• github.com/Spajed/processrefund
• github.com/KernelMode/Process_Doppelganging
• github.com/hasherezade/process_doppelganging
• github.com/m0n0ph1/Process-Hollowing
• github.com/KernelMode/RunPE-ProcessHollowing
• github.com/KernelMode/RunPE_Detecter

pe loader

• github.com/FrankStain/pe-loader
• github.com/VideoCardGuy/PELoader

memory pe dumper

• github.com/glmcdona/Process-Dump

dll map detection

• github.com/vmcall/MapDetection

dll to shellcode

• github.com/w1nds/dll2shellcode

dll to exe

• github.com/hasherezade/dll_to_exe

hide process

• github.com/M00nRise/ProcessHider

hide & delete dll

• github.com/strivexjun/HideDll
• github.com/wyyqyl/HideModule

load driver from memory

• github.com/rogerxiii/kernel-codecave-poc
• github.com/ZhuHuiBeiShaDiao/DriverMaper
• github.com/fadetrack/KernelMemoryModule (Enable Exception)
• github.com/not-wlan/driver-hijack
• github.com/Professor-plum/Reflective-Driver-Loader

bypass memory scanner

• github.com/Microwave89/rtsectiontest

KeUserModeCallBack

• github.com/Sqdwr/KeUserModeCallBack

callback

• github.com/Vicshann/PEProtectDrv
• github.com/fdiskyou/windows-ps-callbacks-experiments
• github.com/maxkray13/Cvc (Communication via callback)
• github.com/socjordi/sauron
• github.com/OSRDrivers/kmexts (callbacks)
• github.com/godaddy/procfilter (yara-integrated)
• github.com/McSimp/unfairplay
• github.com/jjdredd/procsentinel (verify the address space of a process)
• github.com/SanseoLab/simpleAVdriver
• github.com/SanseoLab/ProcLogger
• github.com/notscimmy/libelevate
• github.com/ZhuHuiBeiShaDiao/ObRegisterCallBacksByPass
• github.com/Sqdwr/RemoveCallBacks
• github.com/JKornev/hidden
• github.com/binbibi/CallbackEx
• github.com/swwwolf/cbtest
• github.com/nmgwddj/Learn-Windows-Drivers
• github.com/SamLarenN/CallbackDisabler

keyboard filter

• github.com/supermanc88/KeyboardEncrypt

usb filter

• github.com/