
lithium-kernel
Windows kernel-mode driver with user-mode client exposing IOCTL-based physical and virtual memory read/write, page table walking, pattern scanning,…

Windows kernel-mode driver with user-mode client exposing IOCTL-based physical and virtual memory read/write, page table walking, pattern scanning,…

Simple Process Dumper using DMA over a PCIe FPGA device

Visualize the virtual address space of a Windows process on a Hilbert curve.

empty_list - exploit for p0 issue 1564 (CVE-2018-4243) iOS 11.0 - 11.3.1 kernel r/w

Proof-of-concept exploit for CVE-2020-27949, demonstrating arbitrary memory read/write in macOS processes via DTrace fasttrap ioctl without elevated…

CVE-2026-50416: Windows 11 KASLR bypass

An open-source user mode debugger for Windows. Optimized for reverse engineering and malware analysis.

Read-only Windows forensic scanner for software traces — persistence, execution artifacts (Prefetch, Shimcache, BAM), user activity and Ghost Tasks…

Memory API proxy via signed mozglue.dll

CVE-2017-13868: Information leak of uninitialized kernel heap data in XNU.

Lenovo Diagnostics Driver EoP - Arbitrary R/W

Master's thesis research on CVE-2021-4034 (PwnKit) local privilege escalation. Multi-payload Python exploit with 7 modes including interactive shell,…

Dump LSASS via physical memory read primitives in vulnerable kernel drivers

This tool demonstrates CVE-2026-38194, a vulnerability in Teledyne Digital Imaging Sapera Memory Manager (v9.0.0.0 and below). The CORMEM.SYS kernel…

Exploit for CVE-2026-46215, a Linux kernel DRM GEM use-after-free local privilege escalation. Uses racing, slab spraying, and Dirty Pipe-style file…

Cobalt Strike UDRL that performs advanced module stomping using VEH to intercept calls, unmap modules during sleep, and remap fresh modules to evade…

Runtime JVM analysis toolkit for inspecting classes, methods, fields, constant pool, and bytecode

Virtual Machine Introspection, Tracing & Debugging