Advanced native-mode utility for bypassing DSE and HVCI. Implements smart SeCiCallbacks patching and independent management of Memory Integrity settings. Operating as a subsystem:native app, it ens…

Windows 11 kernel research framework demonstrating DSE bypass on Windows 11 25H2 through boot-time execution. Loads unsigned drivers by surgically patching SeCiCallbacks via native subsystem. Inclu…

Static devirtualizer for VMProtect 3.0-3.5. Lifts virtualized code to LLVM using Remill and strips the VM layer through optimization.

Riot Vanguard streamed module to PE converter. Resolves hashed imports, reconstructs sections, and writes valid DLLs from RITO format binaries.

Native multi-arch disassembler & decompiler - PE/ELF/Mach-O, x86/x64/ARM64, Lua scripting, RTTI recovery

poc it like it's hot

A bin2bin code virtualizer for x86-64 PE's

simple PE packer/crypter for Windows. compresses and encrypts executables with a custom virtual machine into a self-extracting stub.

Intel 64/Windows low-level experiments

Writing a compiler in a week-end

Quickly find bottlenecks in Rust - one profiler for CPU, time, memory, and async code.

Devirtualizer for binaryshield

An x86-64 code virtualizer for VM based obfuscation

LLVM based devirtualizer for the binaryshield software protector.

An analysis and static deobfuscation of codedefender.io protected samples.

MimIR is my Intermediate Representation

Multiplatform MEMORY.DMP analysis tool with a WinDbg flavor

🐝🦀🔥 Rust-based eBPF CPU profiler, supports stack unwinding

SPiCa (System Process Integrity & Cross-view Analysis) is a high-performance, eBPF-based rootkit detection engine written in Rust, inspired by the hatsune miku song SPiCa

Beginner, advanced, expert level Rust training material

MBA deobfuscator via Program Synthesis and Term Rewriting

Bring your own Unwind Data Framework

Stealth-focused Intel VT-x hypervisor (EAC/BE/ACs/AVs).

Linux kernel integrity monitor for detecting syscall hooking

Linker for Beacon Object Files

Easily assign underlying errors into domain-specific errors while adding context

The materials of the "Hypervisors for Hackers: Security from the Hardware Up" class held at Global Cybersecurity Camp 2026 Vietnam.

[WIP] claude opus x86_64 disassembler/lifter/recompiler

A Rust template for writing Beacon Object Files (BOFs)

rax is a CPU emulator that does not trust itself.