Wezo

x64 Dynamic Reverse Engineering Toolkit

Abusing mhyprotect to kill AVs / EDRs / XDRs / Protected Processes.

Stealth-focused Intel VT-x hypervisor (EAC/BE/ACs/AVs).

Unsigned driver loader using CVE-2018-19320

Abusing nvidia driver (nvoclock.sys) for physical/virtual memory and control register manipulation.

Achieve arbitrary kernel read/writes/function calling in Hypervisor-Protected Code Integrity (HVCI) protected environments calling without admin permissions or kernel drivers.

Recursive and arbitrary code execution at kernel-level without a system thread creation

Demystifying PatchGuard is a comprehensive analysis of Microsoft's security feature called PatchGuard, which is designed to prevent unauthorized modifications to the Windows kernel. The analysis is done through practical engineering, with a focus on understanding PatchGuard's inner workings.

"Bypassing" HVCI via donor PFN swaps to modify read-only code pages. Call chained kernel functions (kCET and SLAT support), and more.

Reverse Engineering a signed kernel driver packed and virtualized with VMProtect 3.6

Usermode NT Explorer - Query kernel addresses, translate virtual to physical addresses, inspect the PFN database, and more.

Virtual and physical memory hacking library using gigabyte vulnerable driver

Abusing AsusBiosIoDrv64.sys to gain kernel and process physical/virtual memory access.

Reverse of MSI's MAG X670E TOMAHAWK WIFI bios v1KB (2026-03-20) which claims "Implemented the anti-cheat mechanism" in the release notes.

No description.

simple program for xorcrypting and storing files into media files like audios, images and videos while maintaining integrity.

Cross-platform SIMD assembler that emits unified vector instructions to native x86, ARM, and RISC-V machine code.

The Windows Research Kernel (WRK)

Deobfuscation via optimization with usage of LLVM IR and parsing assembly.

🍯 A hybrid system written in modern C++ for backend systems.

🍯 An OS that aims to provide an alternative for backend systems. (Edge Computing, Storage Systems, etc.)

Coefficient-Based Reconstruction of Arithmetic — a Mixed Boolean-Arithmetic (MBA) expression simplifier for deobfuscation

anvill forges beautiful LLVM bitcode out of raw machine code

IA32-doc is a project which aims to put as many definitions from the Intel Manual into machine-processable format as possible

No description.

A lightweight separation kernel designed specifically for adaptability, real-time computing, and mixed-criticality workloads

A superoptimizer for LLVM IR

Library for lifting machine code to LLVM bitcode