ModTracer Finds Hidden Linux Kernel Rootkits and then make visible again. Another way to make an LKM visible is using the imperius trick: https://github.com/MatheuZSecurity/Imperius …
Blackbone – Windows Memory Hacking Library
Windows memory hacking library Features x86 and x64 support Process interaction Manage PEB32/PEB64 Manage process through WOW64 barrier Process Memory …
PPLcontrol – Controlling Windows PP(L)s
This tool allows you to list protected processes, get the protection level of a specific process, or set an arbitrary …
Hidden – Windows Driver With Usermode Interface Which Can Hide Processes, File-System And Registry Objects, Protect Processes And Etc
Hidden has been developed like a solution for reverse engineering and researching tasks. This is a windows driver with a …
Usbsas – Tool And Framework For Securely Reading Untrusted USB Mass Storage Devices
usbsas is a free and open source (GPLv3) tool and framework for securely reading untrusted USB mass storage devices. Description …
FalconEye – Real-time detection software for Windows process injections
FalconEye is a windows endpoint detection software for real-time process injections. It is a kernel-mode driver that aims to catch …
PPLdump – Dump The Memory Of A PPL With A Userland Exploit
This tool implements a userland exploit that was initially discussed by James Forshaw (a.k.a. @tiraniddo) – in this blog post …
Metarget – Framework Providing Automatic Constructions Of Vulnerable Infrastructures
1 Introduction Metarget = meta- + target, a framework providing automatic constructions of vulnerable infrastructures, used to deploy simple or …
WinPmem – The Multi-Platform Memory Acquisition Tool
The WinPmem memory acquisition driver and userspace WinPmem has been the default open source memory acquisition driver for windows for …
IPCDump – Tool For Tracing Interprocess Communication (IPC) On Linux
Announcement post ipcdump is a tool for tracing interprocess communication (IPC) on Linux. It covers most of the common IPC …