This repository is an antivirus evasion toolkit designed to help bypass security detection through various techniques. It provides tools to encrypt shellcode using XOR and Base64 encoding, along with loaders that decrypt and execute the payload in memory while implementing anti-analysis checks. The toolkit has evolved over time with versions in C, Nim, and C++, showing progressively more sophisticated evasion techniques including API hooking, memory patching, string obfuscation, and cryptographic payload protection. The code demonstrates understanding of Windows internals and offensive security techniques.
AntiDebug Breaker is a Chrome extension (Manifest V3) designed for JavaScript reverse engineering and penetration testing. It injects over 30 modular hook scripts into web pages to bypass anti-debugging techniques (e.g., `debugger` statements, `console.clear`, time-diff detection), intercept browser APIs (`XMLHttpRequest`, `fetch`, `localStorage`, `sessionStorage`, `JSON.parse`, `JSON.stringify`, `Math.random`, `Date.now`, `performance.now`), and extract cryptographic operations (CryptoJS, JSEncrypt, SM-crypto). It also detects Vue.js and React Router routes by traversing internal DOM fiber trees and exposes them in a popup UI for copying or opening. The extension operates via a background service worker, a content script injected at `document_start`, and a popup interface that allows per-domain or global script toggling with fine-grained configuration (e.g., keyword filtering, value overrides). Each hook script is a self-contained Tampermonkey-style unit that communicates with the extension via `window.postMessage` and `localStorage` flags, making them usable independently outside the extension. The codebase demonstrates strong practical utility for security researchers, but suffers from monolithic popup logic, reliance on brittle internal framework properties, and a lack of automated tests.
ExplorerPatcher is a Windows shell customization utility that operates by DLL injection and API hooking inside explorer.exe and related shell processes. In production it ships a patcher DLL (loaded via a dxgi.dll stub renamed into the Explorer directory), a settings GUI (ep_gui.dll, launched via rundll32 dxgi.dll,ZZGUI), an installer/uninstaller (ep_setup.exe), a WebView2-based weather COM host, an Alt+Tab replacement module, and a Start menu patching module (ep_startmenu). At runtime it reads feature toggles from HKEY_CURRENT_USER\Software\ExplorerPatcher, hooks undocumented internal COM interfaces and WinRT activation factories, applies inline machine-code patches and vtable replacements, and restores Windows 10 taskbar, Start menu, context menus, and Alt+Tab behaviors on Windows 11. It also downloads symbols from Microsoft symbol servers and uses byte-pattern scanning to resolve version-specific function offsets. Architecturally this is a suite of loosely coordinated native Windows modules rather than a monolith: the core patcher coordinates them, a chainloader (ep_extra.dll) discovers and loads ep_extra_*.dll plugins, and everything is versioned and bundled by the setup program using AES-encrypted embedded ZIP resources. External dependencies include KNSoft.SlimDetours for hooking, Microsoft WIL, WebView2, zlib, libvalinet, SimpleWindowSwitcher, plus git submodules and a separately downloaded ep_taskbar.dll. The code is heavily build-specific, with x64/ARM64/IA-32 branches and fallback pattern sets for Windows 10/11 builds from 22000 through current 26100+ servicing builds. The craftsmanship is genuinely notable for a reverse-engineering project: ARM64 instruction encode/decode helpers, multi-stage pattern scanners with gap and bitmask variants, SlimDetours transactional IAT hitching, and clean reusable header templates for allocation policy strings and COM ref-counting. The maintenance burden is inherent and huge — every Windows cumulative update risks breaking hardcoded offsets, and the code carries architectural debt from this fight: monumental C files (dllmain.c exceeds 4000 lines), heavy preprocessor branching, dead #if 0 blocks, and no automated test suite. It is not a data/research repository despite containing bundled .pri and .mui localization assets; those are deployment resources, not data artifacts. Despite its fragility, the project tracks Windows updates aggressively (weekly fixes per the changelog) and delivers a working, widely deployed product.
OptiScaler is a graphics enhancement tool that intercepts upscaler calls from games and redirects them to user-selected backends, enabling upscaler replacement (e.g., DLSS to FSR/XeSS) and frame generation. It functions as a DLL that hooks into DirectX 11/12 and Vulkan APIs to inject custom rendering behavior. The architecture is modular with clear separation between hooking systems, upscaler implementations, frame generation, low-latency technologies, and configuration management. Key entry points include dllmain.h (DLL entry point), hooking modules in hooks/, feature providers in upscalers/, and frame generation implementations in framegen/. The system relies heavily on external SDKs (NVIDIA NGX, AMD FidelityFX, Intel XeSS) and uses Detours for API interception. While well-structured with good abstraction patterns, the codebase shows signs of maintenance complexity due to supporting multiple APIs and upscaler versions, creating combinatorial complexity in testing and compatibility.
RedEdr is a Windows telemetry recorder designed for red teams and malware developers to assess detection surface before hitting a real EDR. It captures events from multiple Windows security layers: ETW (Event Tracing for Windows), ETW-TI (Threat Intelligence), kernel callbacks, and user-mode API hooks via Detours. The system comprises a main orchestrator (RedEdr.exe) that starts all reader subsystems, a kernel driver (RedEdrDriver.sys) for process/thread/image callbacks and KAPC injection, a DLL (RedEdrDll.dll) injected into target processes for ntdll.dll hooking, and a PPL service (RedEdrPplService.exe) that consumes ETW-TI events. An embedded web server (port 8081) serves a REST API and a client-side log viewer for filtering and analyzing captured events. The architecture follows a producer-consumer pattern: events from all sources (ETW, kernel pipe, DLL pipe, PPL pipe) are aggregated into a central EventAggregator, augmented with process and memory context, and then stored for retrieval via the web API. Inter-component communication relies on named pipes with simple ASCII command protocols. The kernel driver also includes an ELAM driver to allow the PPL service to run as a protected process. While the project demonstrates deep Windows internals knowledge and provides a comprehensive telemetry capture system, it has significant maintenance risks: hardcoded paths (C:\RedEdr\), fragile driver build dependencies, minimal unit test coverage, and several commented-out hooks in the injected DLL. The codebase is functional for its intended red-team use case but is not production-grade without substantial hardening.