Core Developer for the @volatilityfoundation | Director of R&D for @huntresslabs | Overall DFIR enthusiast.
Stars
12
stars
written in C++
Clear filter
Detours is a software package for monitoring and instrumenting API calls on Windows. It is distributed in source code form.
Framework for lifting x86, amd64, aarch64, sparc32, and sparc64 program binaries to LLVM bitcode
Disable PatchGuard and Driver Signature Enforcement at boot time
Fun with the Windows Subsystem for Linux (WSL/LXSS)
Incident Response & Digital Forensics Debugging Extension
pseudo-code to show how to disable patchguard with win10
Hypervisor based tool for monitoring system register accesses.