kernullist Claim this profile

WinDbg x64 extension that disassembles live functions and uses an LLM to produce verified pseudocode.

Windows kernel research tool. Looks like a debugger, but it is not a debugger. It uses a kernel driver to provide a WinDbg-like live kernel debugging experience from a TUI console.

kernullist-blog

An IDA Pro / Hex-Rays plugin that turns noisy pseudocode into reviewable, kernel-aware cleanup artifacts

User-mode ETW interception and telemetry manipulation lab for Windows security research.

Modern Win32 API monitor for Windows security, reverse engineering, debugging, and anti-cheat research.

Kernforge is a project intelligence and fuzzing workbench for Windows security, anti-cheat engineering, and evidence-backed verification.

Process Filter for Python

Windows kernel Big Pool snapshot/diff tool with a kernel-mode driver and a Go TUI.

Windows Kernel Mode PCRE

Gamified code review: four legendary tech personas debate your source code with real-time speech bubbles, neon line highlighting, and 16-bit RPG visuals.

Rubbish Collection

A neon audio utility that controls real Windows playback devices directly, auto-switches on game launch

A Windows minifilter-backed file capture tool. Tracks processes that run under user-specified watch roots and their descendants.

ARIA implementation with Go

100% offline, on-device local semantic document search for Windows (Tauri + Python, sqlite-vec). Spotlight-style popup, hybrid search, OCR, system tray.

A browser-based desktop where AI Agent operates every app through natural language.

Your writing style, distilled into a Skill.md for AI agents.

Guard your AI agent rules — lints AGENTS.md, CLAUDE.md & Cursor rules for conflicts, duplication, bloat, and drift from real code.

AI-Powered Reverse Engineering Plugin for IDA Pro

Native API header files for the Process Hacker project.

No description.

💖🧸 Self hosted, you-owned Grok Companion, a container of souls of waifu, cyber livings to bring them into our worlds, wishing to achieve Neuro-sama's altitude. Capable of realtime voice chat, Minecraft, Factorio playing. Web / macOS / Windows supported.

Windows tray utility that solves two chronic display/power annoyances with one tool.

kernel-corpus

No description.

Type-casting for your clipboard. Instantly format copied data into clean JSON, Markdown, YAML, SQL IN, and TSV.

The official Windows Driver Kit documentation sources

FocusOn is an ultra-lightweight, high-performance distraction dimmer utility for Windows, written entirely in Rust. It helps you focus on your current task by dimming inactive screens and background windows, keeping only the active window illuminated.

전국의 전시·축제·공연·팝업스토어 일정을 지도 + 캘린더로 한눈에 보여주는 서비스

AI 기반 영어 발음 교정 웹 애플리케이션

A Tactile Liquid Brain-Mapping & Generative AI Thought Synthesis Board

A premium native desktop wellness station and procedural ambient sound synthesizer designed to prevent computer fatigue, restore cognitive focus, and guide you through calming somatic rest cycles.

Advanced driver monitoring utility.

Local bridging service that instantly shares files bidirectionally between mobile and Windows PC inside the same network environment—wire-free, account-free, and setup-free.

Steelman Counter-Argument Generator — AI-driven debate adversary

AI Coding Assistant Extension for Visual Studio

Multi-repo code analysis dashboard with AST parsing, open-source linter integration (cppcheck/pylint/PMD/ESLint), ML-based commit purpose classification, and hybrid feedback scoring. On-premises Flask app.

A Virtual Machine Monitor for modern Cloud workloads. Features include CPU, memory and device hotplug, support for running Windows and Linux guests, device offload with vhost-user and a minimal compact footprint. Written in Rust with a strong focus on security.

Let Codex finish long-running work, say thanks, and shut down your PC.

BriefWave Cast is a Korean AI news podcast generator powered by Gemini, ElevenLabs, and FastAPI.

merge 2 xlsm files into 1 xlsm file.

A comprehensive tool for analyzing and enhancing creative writing with AI-powered insights.

LIBERATED AI CHAT

An open source template for building cloud agents.

Fast and accurate AI powered file content types detection

Symphony turns project work into isolated, autonomous implementation runs, allowing teams to manage work instead of supervising coding agents.

🪅 Windows User Space Emulator

A reverse-engineering agent for IDA Pro and Binary Ninja

A modern 32/64-bit position independent implant template

GitNexus: The Zero-Server Code Intelligence Engine - GitNexus is a client-side knowledge graph creator that runs entirely in your browser. Drop in a GitHub repo or ZIP file, and get an interactive knowledge graph wit a built in Graph RAG Agent. Perfect for code exploration

Nidhogg is an all-in-one simple to use windows kernel rootkit.

Intercept LLM API traffic and visualize token usage in a real-time terminal dashboard. Track costs, debug prompts, and monitor context window usage across your AI development sessions.

Your own personal AI assistant. Any OS. Any Platform. The lobster way. 🦞

A simple cross-platform tool to hide files inside PNG images

This is the loader that supports running a program with Protected Process Light (PPL) protection functionality.

EDR-Freeze is a tool that puts a process of EDR, AntiMalware into a coma state.

Obex – Blocking unwanted DLLs in user mode

Direct access to NTFS volumes

KittyLoader is a highly evasive loader written in C / Assembly

PoCs for Kernelmode rootkit techniques research.

Virtual Trust Level (VTL 1) secure call tracing

Bypass user-land hooks by syscall tampering via the Trap Flag

A powerful Windows command-line tool for analyzing and searching ETW (Event Tracing for Windows) provider permissions from the Windows registry.

The different ways to dump lsass

Two tools written in C that block network traffic for blacklisted EDR processes, using either Windows Defender Firewall (WDF) or Windows Filtering Platform (WFP).

A comprehensive ETW (Event Tracing for Windows) event generation tool designed for testing and research purposes.

Hells Hollow Windows 11 Rootkit technique to Hook the SSDT via Alt Syscalls

No description.

Waiting Thread Hijacking - injection by overwriting the return address of a waiting thread

Code execution/injection technique using DLL PEB module structure manipulation

Reflective shellcode loaderwith advanced call stack spoofing and .NET support.

No description.

A framework to study Exploit Kits

SoftICE-like kernel debugger for Windows 11

A Go implementation of Cobalt Strike style BOF/COFF loaders.

a tool used to analyze and monitor in named pipes

CWE-781: Improper Address Validation in IOCTL with METHOD_NEITHER I/O Control Code

A library to develop kernel level Windows payloads for post HVCI era

Achieve arbitrary kernel read/writes/function calling in Hypervisor-Protected Code Integrity (HVCI) protected environments calling without admin permissions or kernel drivers.

x64 Assembly HalosGate direct System Caller to evade EDR UserLand hooks

Indirect Dynamic Syscall, SSN + Syscall address sorting via Modified TartarusGate approach + Remote Process Injection via APC Early Bird + Spawns a sacrificial Process as target process + (ACG+BlockDll) mitigation policy on spawned process + PPID spoofing + Api resolving from TIB + API hashing

Code injection on Android without ptrace

OffSec OSINT Pentest/RedTeam Tools

Tool to remotely dump secrets from the Windows registry

DLL proxying for lazy people

Demo proof of concept for shadow regions, and implementation of HyperDeceit.

BottlEye is a usermode emulator for the popular anti-cheat BattlEye

Rusty Rootkit: Windows Kernel Driver in Rust for Red Teamers

Rust bindings to Windows API

IDA plugin which queries OpenAI's davinci-003 language model to speed up reverse-engineering

An example of a client and server using Windows' ALPC functions to send and receive data.

PortAudio is a cross-platform, open-source C language library for real-time audio input and output.

No description.

☄️ Reverse engineering and analysis of Call of Duty: Black Ops III

WNF Code Execution Library Using C#

Collect various versions of ntoskrnl files

No description.

Mangle is a tool that manipulates aspects of compiled executables (.exe or DLL) to avoid detection from EDRs

A Highly capable Pe Packer

Vmware Hardened VM detection mitigation loader (anti anti-vm)

Loads a signed kernel driver which allows you to map any driver to kernel mode without any traces of the signed / mapped driver.

Kernel Driver Utility

Hiding the window from screenshots using the function win32kfull::GreProtectSpriteContent

Windows inline hooking tool.

PoC: DX11 overlay over DWM

noob hooking dwm for overlay

Kernel cheat with kernel hook for communication

Events from all manifest-based and mof-based ETW providers across Windows 10 versions

WinToast is a lightly library written in C++ which brings a complete integration of the modern toast notifications of Windows 8 & Windows 10. Toast notifications allows your app to inform the users about relevant information and timely events that they should see and take action upon inside your app, such as a new instant message, a new friend request, breaking news, or a calendar event.

Document ETW providers

Tools and technical write-ups describing attacking techniques that rely on concealing code execution on Windows

An automatic unpacker and logger for DotNet Framework targeting files

The first dynamic analysis framework for CPU microcode

A bunch of parsers for PE and PDB formats in C++

No description.

LoadLibrary for offensive operations

No description.

A small PoC that creates processes in Windows

collection of apis used in malware development

Helper script for Windows kernel debugging with IDA Pro on native Bochs debugger (including PDB symbols)

This is the P.O.C source for hooking the system calls on Windows 10 (1903) using it's dynamic trace feature weakness

RIPPL is a tool that abuses a usermode only exploit to manipulate PPL processes on Windows

No description.

Dynamic unpacker and import fixer for Themida/WinLicense 2.x and 3.x.

obfuscator-llvm 移植到llvm13

Malware rapid development framework

Execute PowerShell code at the antimalware-light protection level.

Collection of shellcode injection techniques packed in a D/Invoke weaponized DLL

Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from memory and runs them with parameters

Turn off PatchGuard in real time for win7 (7600) ~ later

Code used in this post https://captmeelo.com/redteam/maldev/2022/04/21/kernelcallbacktable-injection.html

Some Code Samples for Windows based Inter-Process-Communication (IPC)

NVIDIA Linux open GPU kernel module source

Command line access to the Registry

Full featured, offline Registry parser in C#

A C++ compression and decompression program based on Huffman Coding.

Forensics tool for NTFS (parser, mft, bitlocker, deleted files)

Windows registry file format specification

Different aproaches to detecting EPT hooks

Hypervisor and EPT hooking experiments.

KDMapper is a simple tool that exploits iqvw64e.sys Intel driver to manually map non-signed drivers in memory

No description.

Mapping your code on a 0x1000 size page

undetected eac mapper

No description.

Internal SDK generator for Unreal Engine 3 games.

driver mapper / capcom wrapper

A forensics tool to convert the data in the Windows srum (System Resource Usage Monitor) database to an xlsx spreadsheet.

Windows Prefetch parser. Supports all known versions from Windows XP to Windows 10.

No description.

AppCompatCache (shimcache) parser. Supports Windows 7 (x86 and x64), Windows 8.x, and Windows 10

No description.

A repo for centralizing ongoing research on the new Windows 10/11 DFIR artifact, EventTranscript.db.

UEDumper

Rootkit & Anti-rootkit

Yet another variant of Process Hollowing

list of bug bounty writeups

Simple (mainly PowerShell) solutions allowing you to dig a bit deeper than usual.

A not so awesome list of malware gems for aspiring malware analysts

This is the development tree. Production downloads are at:

Hygieia, a vulnerable driver traces scanner written in C++ as an x64 Windows kernel driver.

An x64 page table iterator written in C++ as a kernel mode windows driver.

driver manual mapper (outdated/for educational purposes)

A small POC to make defender useless by removing its token privileges and lowering the token integrity

No description.

Kernel mode WinDbg extension and PoCs for token privilege investigation.

Great explanation of Process Hollowing (a Technique often used in Malware)

Process Ghosting - a PE injection technique, similar to Process Doppelgänging, but using a delete-pending file instead of a transacted file

No description.

Transacted Hollowing - a PE injection technique, hybrid between ProcessHollowing and ProcessDoppelgänging

Process Doppelgänging

AntiSpy is a free but powerful anti virus and rootkits toolkit.It offers you the ability with the highest privileges that can detect,analyze and restore various kernel modifications and hooks.With its assistance,you can easily spot and neutralize malwares hidden from normal detectors.

内核编程实践-ARK工具（AntiRootKit）

Loading dbk64.sys and grabbing a handle to it

Simple Encrypted Arithmetic Library (SEAL) is an easy-to-use but powerful homomorphic encryption library written in C++. It supports both the BFV and the CKKS encryption schemes.

PlayStation 4 Debugger

A library to manipulate physical memory from usermode.

No description.

update face injector by KANKOSHEV

External Hooking ( Bypasss process byte patching checks | Injector included )

Windows memory hacking library

Binary instrumentation framework based on FRIDA

Simple Process Hollowing in C#

This repo is for experimentation and exploring new ideas that may or may not make it into the main dotnet/runtime repo.

Bringing kernel driver to C# with MichalStrehovsky's zerosharp

C# Kernel Mode Driver to read and write memory in protected processes

C# Kernel Mode Driver example using NativeAOT

Capstone disassembly/disassembler framework: Core (Arm, Arm64, M68K, Mips, PPC, Sparc, SystemZ, X86, X86_64, XCore) + bindings (Python, Java, Ocaml, PowerShell)

Windows kernel and user mode emulation.

No description.

Build a Jekyll blog in minutes, without touching the command line.

Microsoft Windows 2000 Professional — (Source Codes)

A Qt and C++ GUI for radare2 reverse engineering framework

No description.

An improvement of the original reflective DLL injection technique by Stephen Fewer of Harmony Security

Call 32bit NtDLL API directly from WoW64 Layer

Windows Implementation Library

Process Herpaderping proof of concept, tool, and technical deep dive. Process Herpaderping bypasses security products by obscuring the intentions of a process.

Dumps information about all the callback objects found in a dump file and the functions registered for them