Awesome Game Security

A Linux framework to enable userspace-defined "Virtual" PCIe card shims to enable in-host PCIe card driver development.

Unsigned driver loader using CVE-2018-19320

Elden Ring Cheat Engine table maintained by The Grand Archives.

No description.

Research on Windows Kernel Executive Callback Objects

No description.

Process Injection using Thread Name

This repository contains tools to perform modern cache attacks on ARM.

Unlocking qualcomm bootloader

Exploits for Android Binder bug CVE-2020-0041

Abyss Engine clean-room reimplementation of Diablo 2, written in C. The goal is to recreate the original game engine, but on a portable platform that can also easily be modded and extended.

Evading WinDefender ATP credential-theft

Some research on AltSystemCallHandlers functionality in Windows 10 20H1 18999

Android system call hook

Proof of Concepts code for Bring Your Own Vulnerable Driver techniques

An IDA plugin that eases reversing of binaries that have been code-size-optimized with function outlining

No description.

No description.

midgetpack is a multiplatform secure ELF packer

Use hardware breakpoints to spoof the call stack for both syscalls and API calls

一个基于uprobe，能同时hook大量用户地址空间函数的kpm内核模块

alternative smm driver for ryzen motherboards

A Hyper-V Hacking Framework For Windows 10 x64 (AMD & Intel)

Kernel mode bypass for BattlEye, EAC

manually map driver for a signed driver memory space

Free open-source training software / cheat for Counter-Strike: Global Offensive, written in C.

Converted phnt (Native API header files from the System Informer project) to IDA TIL, IDC (Hex-Rays).

Malware Behavior Analyzer

Disks for DMA

silent syscall hooking without modifying sys_call_table/handlers via patching exception handler

Chasm Runtime Assembler.

Simple DLL that spoofs EasyAntiCheat on most games

It's a kernel-based keylogger for Windows x86/x64.

Intercepting DeviceControl via WPP

Analyze Windows x64 Kernel Memory Layout

Simple ELF crypter. Uses RC4 encryption.

The beginning and end of Devilution - Diablo reverse engineered

This x64dbg plugin sets the page protection for memory mapped views in scenarios which cause NtProtectVirtualMemory to fail.

Windows PDB parser for kernel-mode environment.

Proof of Concepts code for Bring Your Own Vulnerable Driver techniques

🍂 Android aarch64 kernel driver module providing efficient memory operations, touch simulation and IPC. Features include fast memory remapping.

A zygisk module that dumps so file from process memory

Proof-of-concept kernel driver that hijacks the Windows kernel extension table mechanism to preserve process notify callbacks even when attackers disable standard process notify callbacks.

Kasumi - a kernel-level path manipulation and hiding framework

just proof of concept. hooking MmCopyMemory PG safe.

Arm64 inline hooking for iOS, Android, OSX, and Linux.

No description.

Packet crafting, injection and sniffing tool

x64dbg plugin for running python3 script. Focus on doing malware analyst and unpacking

No description.