saileaxh

Lightweight, dependency-free x86-64 CPU emulation library with Unicorn-like guest mode and direct host-memory execution.

Faster, with excellent architecture, stronger performance, and kernel access support — an ida-mcp tool

Windows Kernel Security: Memory Integrity Verification with Disk Verification of ntoskrnl.exe

Machine-learning-based function similarity analysis that helps you quickly locate matching functions across different versions of x64 binaries.

An IDA Pro plugin that uses machine learning to find matching functions between two binary files, letting you carry over function labels from an old version of a program to a newer one automatically.

EAC_Like_Import_Encrypt

An example of using DwmRegisterThumbnail to completely replicate content from another window and overlay custom content on top of it

Windows kernel-mode driver designed for monitoring and security analysis of Windows 11 I/O Ring operations. Provides detection capabilities for IoRing-based exploitation attempts, WinRing0.sys, pool spray attacks, and cross-process buffer manipulation.

2025腾讯游戏安全技术竞赛初赛题解源码

Blazing fast and correct x86/x64 disassembler, assembler, decoder, encoder for Rust, .NET, Java, Python, Lua

A Windows Kernel Driver Emulator base on Unicorn, Kernel Memory Dump and some of native environment

Simpleator ("Simple-ator") is an innovative Windows-centric x64 user-mode application emulator that leverages several new features that were added in Windows 10 Spring Update (1803), also called "Redstone 4", with additional improvements that were made in Windows 10 October Update (1809), aka "Redstone 5".

使用Github Action自动编译一加SukiSU内核

Open EDR public repository

simple driver to read and write

An IDA Pro plugin that simulate time-travel debugging by emulating code execution with Unicorn.

This project aims at simplifying Windows API import recovery on arbitrary memory dumps

Sanctum is an experimental proof-of-concept EDR, designed to detect modern malware techniques, above and beyond the capabilities of antivirus. Built in Rust.

:cloud: Collaborative Malware Analysis Platform at Scale

DRAKVUF Sandbox - automated hypervisor-level malware analysis system

The repository contains the code for Windows console based application that uses Intel-SGX platform for file encryption/decryption using random keys.

UEFI Bootkit with user-mode communication

Super UEFIinSecureBoot Disk: Boot any OS or .efi file without disabling UEFI Secure Boot

No description.

Detect-KeAttachProcess by iterating through all processes as well as checking the context of the thread.

A stealthy anti-fingerprinting toolkit for Windows

No description.

新一代SKRoot，挑战全网root检测手段，跟面具完全不同思路，摆脱面具被检测的弱点，完美隐藏root功能，全程不需要暂停SELinux，实现真正的SELinux 0%触碰，通用性强，通杀所有内核，不需要内核源码，直接patch内核，兼容安卓APP直接JNI调用，稳定、流畅、不闪退。