
Driver-KeAttachProcess-KeDetachProcess-rebuild
Rebuild of Windows kernel driver functions KeAttachProcess and KeDetachProcess, used for process attachment and anti-cheat bypass research.

Rebuild of Windows kernel driver functions KeAttachProcess and KeDetachProcess, used for process attachment and anti-cheat bypass research.

Ghidra plugin that automates UEFI firmware analysis by identifying known GUIDs, protocols, SMI handlers, and interrupt functions, with headless…

In-depth reverse engineering analysis of Lumma Stealer, an info-stealer using process hollowing, Native API calls, and C2 communication. Includes…

A revival of the classic and legendary KsDumper

The PoC of information disclosure in Microsoft Desktop Windows Management.

Automates repair of malformed UPX headers in ELF binaries, restoring magic, filesize, blocksize, and overlay fields so standard unpackers can process…

x64 Dynamic Reverse Engineering Toolkit

A reference of Windows API function calls, including functions for file operations, process management, memory management, thread management,…

find dll base addresses without PEB WALK

A lightweight dynamic instrumentation library

Red Team C code repo

In-memory stealth detection tool that identifies process hollowing, module stomping, unbacked executable regions, and anomalous CONTEXT structures…

CVE-2025-65320 proof-of-concept demonstrating cleartext license key extraction from process memory via debugger attachment, enabling software…

Vulnerability Found on Squid Proxy.

Analysis and PoC for CVE-2025-14174 - ANGLE Metal OOB write (iOS Safari, macOS Chrome)

CVE-2025-61155 — arbitrary process termination in GameDriverX64.sys (Tower of Fantasy anti-cheat). Original IDA Pro teardown, PoC, YARA, IOCs,…

An API hooking framework for intercepting and monitoring Windows applications

A pure-Python library that lets you inspect, modify and search the memory of any running process in a few lines of Python :snake: .