Awesome Game Security

Half-Life 2 SDK Mirrors

Cross-platform streamproof ESP hack for Counter-Strike: Global Offensive, written in modern C++. Rendering and GUI powered by Dear ImGui + FreeType.

A PowerShell script that attempts to help malware analysts hide their VMware Windows VM's from malware that may be trying to evade analysis.

Kernel-Mode Driver that loads a dll into every new created process that loads kernel32.dll module

Counter-Strike 2 SDK/Base written in C++.

Debugger Anti-Detection Benchmark

Loads a signed kernel driver which allows you to map any driver to kernel mode without any traces of the signed / mapped driver.

ROPium is a tool that helps you building ROP exploits by finding and chaining gadgets together

GptHidra is a Ghidra plugin that uses the OpenAI Chat GPT to explain functions. With GptHidra, you can easily understand the purpose and behavior of functions in your codebase. Now with GPT4 Support!

Module extending manual mapper

A basic 2D side scroller blueprint template for Unreal Engine 5

Ghidra analyzer for UEFI firmware.

Incident Response & Digital Forensics Debugging Extension

A low-overhead dynamic binary instrumentation and modification tool for ARM (both AArch32 and AArch64 support) and RISC-V (RV64GC).

Venom is a library that meant to perform evasive communication using stolen browser socket

A somewhat wide collection of various kernelmode-usermode communication methods in one repository (mainly just for learning purposes).

Scan signatures and netvars. Dumps header files, cheat tables and ReClass files.

Fumo Loader - All in one kernel-based DLL injector

Examples for: Learning KVM - implement your own kernel

A dnSpy extension to aid reversing of obfuscated assemblies

🕹️ An external CS radar made specifically for observing

GhidRust: Rust decompiler plugin for Ghidra

Lua in kernel-mode because why not.

Updated version of System Management Mode backdoor for UEFI based platforms: old dog, new tricks

strings2: An improved strings extraction tool.

Modding il2cpp games by classes, methods, fields names on Android.

A Linux framework to enable userspace-defined "Virtual" PCIe card shims to enable in-host PCIe card driver development.

Unsigned driver loader using CVE-2018-19320

symbolic execution plugin for binary ninja

.NET Project containing plenty of advanced techniques to detect various types of malicious actions on your software, with syscall support.

The program draws with win32k gdi functions in the kernel while NtGdiDdDDISubmitCommand is being hooked.

pdb + Rich library

KslDump — Why bring your own knife when Defender already left one in the kitchen?

Patching "signtool.exe" to accept expired certificates for code-signing.

D3D11 Worldtoscreen Finder, dx11 w2s, d3d11 w2s, esp, world to screen

Linux anti-debugging and anti-analysis rust library

DPI bypass tool - eBPF on Linux, TUN on macOS/Windows.

CFB is a ProcMon-style tool designed to assist capturing IRPs sent to Windows drivers.

il2cpp各个版本的源码整理

A game launcher for World of Warcraft that allows you to connect to custom servers.

A plugin based on IDAPython for a functional DWIM interface. Current development against most recent IDA is in the "persistence-refactor" branch, ancient (but stable) work is in "master", so... create an issue if you want/need something backported. Use "Wiki" or "Discussions" for examples, and smash that "Star" button if you like this.

An AVX Lifter for the Hex-Rays Decompiler

DragonBurn is CS2(Counter-Strike 2 cheat) kernel-mode read-only external cheat. Undetected by all anti-cheats except Faceit.

IDA Processor Module for the Ethereum Virtual Machine (EVM)

This is a simple, mostly automated guide to pass a GPU through to a VM.

Elden Ring Cheat Engine table maintained by The Grand Archives.

An x86-64 Code Virtualizer

No description.

Research on Windows Kernel Executive Callback Objects

SSL bypass check