lymemory

一款内核级读写工具，可强制读写任意应用层进程内存数据，用于突破游戏驱动保护强行读写对端内存。

malk

Demonstrate calling a kernel function and handle process creation callback against HVCI

mappage

Mapping your code on a 0x1000 size page

medusa

Radical Windows ARK

memoryranger

MemoryRanger protects kernel data and code by running drivers and hosting data in isolated kernel enclaves using VT-x and EPT features. MemoryRanger has been presented at the BlackHat, HITB, CDFSL.

mft_browser

$MFT directory tree reconstruction & record info

mhy_exp

Mhy Exp (exploit signed driver)

mini-filter-driver-framework

A mini filter driver development framework allows you to develop minit filter driver with different features.

mouseclassservicecallbackmeme

Calling "own" MouseClassServiceCallback

ms-dos

The original sources of MS-DOS 1.25, 2.0, and 4.0 for reference purposes

newhidedriverex

Hide Driver By MiProcessLoaderEntry

nidhogg

Nidhogg is an all-in-one simple to use rootkit for red teams.

nmistackwalk

noone

一款windows64位的ark工具 rootkit

nopatchguardcallback

x64 Windows PatchGuard bypass, register process-creation callbacks from unsigned code

nt5src

Source code of Windows XP (NT5). Leaks are not from me. I just extracted the archive and cabinet files.

ntsymbol

Resolve DOS MZ executable symbols at runtime

numen

简单安排一下 autochk.sys 这个rootkit

nvdrv

Abusing nvidia driver (nvoclock.sys) for physical/virtual memory and control register manipulation.

offensiveph

OffensivePH - use old Process Hacker driver to bypass several user-mode access controls

openark

OpenArk is an open source anti-rookit(ARK) tool for Windows.

opennt

OpenNT - Windows OS Compatible - Clone of SVN

openprocmon

open source process monitor

osr_devicetree_vuln

pagetablehook

PageTableEntry_Hook

patchguardbypass

Bypassing PatchGuard on modern x64 systems

phnt

Native API header files for the Process Hacker project.

pinkpanther

Windows x64 handcrafted token stealing kernel-mode shellcode

plugins-extra

These are highly unstable, buggy, incomplete plugins that are not included with Process Hacker by default.

poolfengshui

笔者的在原作者池风水利用工具(以下简称工具)基础上进行二次开发,新增了全自动获取内核调试模块符号的偏移量及配置参数和不同漏洞利用方式优化等功能, 解决了不同Windows版本适配问题,工具包括适配驱动和利用程序两部分组成,实现了在Windows 10 19H1之后任意版本包括满补丁系统上的稳定利用.