Linux kernel source tree

UNIX-like reverse engineering framework and command-line toolset

Capstone disassembly/disassembler framework for ARM, ARM64 (ARMv8), Alpha, BPF, Ethereum VM, HPPA, LoongArch, M68K, M680X, Mips, MOS65XX, PPC, RISC-V(rv32G/rv64G), SH, Sparc, SystemZ, TMS320C64X, T…

A repository for learning various heap exploitation techniques.

Direct Memory Access (DMA) Attack Software

Defeating Windows User Account Control

A native, user-mode, multi-process, graphical debugger.

Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from memory and runs them with parameters

This project hosts security advisories and their accompanying proof-of-concepts related to research conducted at Google which impact non-Google owned code.

State-of-the-art native debugging tools

Simple (relatively) things allowing you to dig a bit deeper than usual.

Reflective DLL injection is a library injection technique in which the concept of reflective programming is employed to perform the loading of a library from memory into a host process.

16-bit Windows (Windows 1.x, 2.x, 3.0, 3.1, etc.) on 64-bit Windows

Prime number projects in 100+ programming languages, to compare their speed - and their programmer's cleverness

Universal local privilege escalation Proof-of-Concept exploit for CVE-2024-1086, working on most Linux kernels between v5.14 and v6.6, including Debian, Ubuntu, and KernelCTF. The success rate is 9…

The swiss army knife of LSASS dumping

Situational Awareness commands implemented using Beacon Object Files

LSASS memory dumper using direct system calls and API unhooking.

Fileless lateral movement tool that relies on ChangeServiceConfigA to run command

Windows NT Syscall tables

Research code & papers from members of vx-underground.

Powerful Disassembler Library For x86/AMD64

Original C Implementation of the Hell's Gate VX Technique

bddisasm is a fast, lightweight, x86/x64 instruction decoder. The project also features a fast, basic, x86/x64 instruction emulator, designed specifically to detect shellcode-like behavior.

Linux LD_PRELOAD rootkit (x86 and x86_64 architectures)

Run Microsoft Windows NTVDM (DOS) on 64bit Editions

The engine that powers DeLorean!

Contains all the material from the DEF CON 31 workshop "(In)direct Syscalls: A Journey from High to Low".

PoC exploits for software vulnerabilities