Linux kernel source tree

UNIX-like reverse engineering framework and command-line toolset

Capstone disassembly/disassembler framework for ARM, ARM64 (ARMv8), Alpha, BPF, Ethereum VM, HPPA, LoongArch, M68K, M680X, Mips, MOS65XX, PPC, RISC-V(rv32G/rv64G), SH, Sparc, SystemZ, TMS320C64X, T…

A repository for learning various heap exploitation techniques.

Direct Memory Access (DMA) Attack Software

Defeating Windows User Account Control

A native, user-mode, multi-process, graphical debugger.

Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from memory and runs them with parameters

This project hosts security advisories and their accompanying proof-of-concepts related to research conducted at Google which impact non-Google owned code.

Pafish is a testing tool that uses different techniques to detect virtual machines and malware analysis environments in the same way that malware families do

State-of-the-art native debugging tools

Simple (relatively) things allowing you to dig a bit deeper than usual.

Reflective DLL injection is a library injection technique in which the concept of reflective programming is employed to perform the loading of a library from memory into a host process.

16-bit Windows (Windows 1.x, 2.x, 3.0, 3.1, etc.) on 64-bit Windows

Prime number projects in 100+ programming languages, to compare their speed - and their programmer's cleverness

Universal local privilege escalation Proof-of-Concept exploit for CVE-2024-1086, working on most Linux kernels between v5.14 and v6.6, including Debian, Ubuntu, and KernelCTF. The success rate is 9…

Abusing impersonation privileges through the "Printer Bug"

The swiss army knife of LSASS dumping

Situational Awareness commands implemented using Beacon Object Files

Fileless lateral movement tool that relies on ChangeServiceConfigA to run command

LSASS memory dumper using direct system calls and API unhooking.

Windows NT Syscall tables

Research code & papers from members of vx-underground.

Powerful Disassembler Library For x86/AMD64

Driver loader for bypassing Windows x64 Driver Signature Enforcement

Original C Implementation of the Hell's Gate VX Technique

bddisasm is a fast, lightweight, x86/x64 instruction decoder. The project also features a fast, basic, x86/x64 instruction emulator, designed specifically to detect shellcode-like behavior.

Linux LD_PRELOAD rootkit (x86 and x86_64 architectures)

Run Microsoft Windows NTVDM (DOS) on 64bit Editions