Special K is a sophisticated Windows game enhancement and injection framework, primarily a C++ DLL injection payload that hooks graphics APIs (DirectX 8/9/11/12, Vulkan, OpenGL, DXGI), input devices, and storefront overlays (Steam, Epic Online Services, GOG Galaxy, Xbox). Its core functionality includes real-time framerate and latency monitoring via ETW trace analysis (PresentMon integration), HDR injection and tone mapping, screenshot capture, shader modification, and a fully customizable ImGui-based control panel for configuring performance overlays, input remapping, and compatibility workarounds for specific games. The project demonstrates high craftsmanship with a modular architecture featuring COM wrapper patterns, a custom hooking infrastructure built on MinHook, and reusable utilities such as a hardware-accelerated CRC32 implementation, a thread-safe lazy singleton, and an INI parser with COM-style interfaces. It bundles extensive third-party dependencies including Boost, GLM, LZMA, and various vendor SDKs. While the codebase is primarily a tool for end users, it also contains data-driven components like game-specific plugin modules and performance event tracing that could inform research into game rendering behavior. The repository is actively maintained with frequent commits, though its large dependency surface and reliance on low-level Windows APIs introduce moderate technical drift risk.
ExplorerPatcher is a Windows shell customization utility that operates by DLL injection and API hooking inside explorer.exe and related shell processes. In production it ships a patcher DLL (loaded via a dxgi.dll stub renamed into the Explorer directory), a settings GUI (ep_gui.dll, launched via rundll32 dxgi.dll,ZZGUI), an installer/uninstaller (ep_setup.exe), a WebView2-based weather COM host, an Alt+Tab replacement module, and a Start menu patching module (ep_startmenu). At runtime it reads feature toggles from HKEY_CURRENT_USER\Software\ExplorerPatcher, hooks undocumented internal COM interfaces and WinRT activation factories, applies inline machine-code patches and vtable replacements, and restores Windows 10 taskbar, Start menu, context menus, and Alt+Tab behaviors on Windows 11. It also downloads symbols from Microsoft symbol servers and uses byte-pattern scanning to resolve version-specific function offsets. Architecturally this is a suite of loosely coordinated native Windows modules rather than a monolith: the core patcher coordinates them, a chainloader (ep_extra.dll) discovers and loads ep_extra_*.dll plugins, and everything is versioned and bundled by the setup program using AES-encrypted embedded ZIP resources. External dependencies include KNSoft.SlimDetours for hooking, Microsoft WIL, WebView2, zlib, libvalinet, SimpleWindowSwitcher, plus git submodules and a separately downloaded ep_taskbar.dll. The code is heavily build-specific, with x64/ARM64/IA-32 branches and fallback pattern sets for Windows 10/11 builds from 22000 through current 26100+ servicing builds. The craftsmanship is genuinely notable for a reverse-engineering project: ARM64 instruction encode/decode helpers, multi-stage pattern scanners with gap and bitmask variants, SlimDetours transactional IAT hitching, and clean reusable header templates for allocation policy strings and COM ref-counting. The maintenance burden is inherent and huge — every Windows cumulative update risks breaking hardcoded offsets, and the code carries architectural debt from this fight: monumental C files (dllmain.c exceeds 4000 lines), heavy preprocessor branching, dead #if 0 blocks, and no automated test suite. It is not a data/research repository despite containing bundled .pri and .mui localization assets; those are deployment resources, not data artifacts. Despite its fragility, the project tracks Windows updates aggressively (weekly fixes per the changelog) and delivers a working, widely deployed product.
Cyber Engine Tweaks (CET) is a Windows DLL plugin (ASI) for Cyberpunk 2077 that provides a Lua scripting environment, an in-game Dear ImGui overlay, and a suite of developer tools for modding. It hooks into the game's DirectX 12 renderer and RED4ext runtime to expose internal game systems (RTTI, TweakDB, singletons, functions) to Lua scripts. The architecture is a singleton orchestrator (CET) that owns subsystems: a Lua VM (sol2 + LuaJIT), an ImGui overlay with dockable widgets (Console, TweakDB Editor, Settings, Bindings, Game Log), a raw input binding system, a persistent state manager, and a set of memory patches (disable vignette, boundary teleport, etc.). Mods are placed in a designated folder and can register callbacks for game events, create UI, manipulate game data, and override game functions via a hooking chain.
VxKex is a Windows compatibility layer that enables applications designed for Windows 8, 8.1, and 10 to run on Windows 7 SP1. It achieves this by injecting a core DLL (KexDll) into target processes via Image File Execution Options (IFEO), rewriting import tables to redirect API calls to extended DLLs (KxBase, KxUser, KxCom, KxDx, etc.) that implement missing or modified functions. The project also includes a kernel-mode driver (KexKMSD), a configuration GUI (KexCfg), an installer (KexSetup), a shell extension (KexShlEx), a log viewer (VxlView), and a launcher (VxKexLdr). The codebase is deeply tied to Windows 7 internals, using undocumented NT APIs, assembly syscall hooks, and version spoofing. It is a monolithic collection of tightly coupled C projects built with the Windows 7.1 SDK and custom build utilities. While functionally impressive and demonstrating deep reverse-engineering skill, the code is informal, contains many stubs and TODO comments, and has limited reusability outside its specific context.
This repository implements the Elden Ring Practice Tool, a Windows application that provides an in-game overlay with cheats, debugging utilities, and speedrun practice features for Elden Ring. The system works by injecting a DLL into the game process, hooking DirectX 12 to render an ImGui overlay, and reading/writing game memory via pointer chains. The architecture is a Cargo workspace with multiple crates: `practice-tool` (main DLL with overlay UI), `lib/libeldenring` (core memory editing and parameter access library), `lib/param-tinkerer` (standalone parameter editor), `lib/no-logo` (intro screen removal DLL), `lib/scripts` (injector), and `xtask` (build and code generation orchestration). Key entry points include `practice-tool/src/lib.rs` (DLL main), `practice-tool/src/practice_tool.rs` (ImGui render loop), and `xtask/src/main.rs` (build tasks). Data flows involve reading game memory via pointer chains, parsing game parameters from community-maintained Paramdex XML, and generating Rust structs and base addresses via AOB scanning. External dependencies include `hudhook` for injection, `imgui` for UI, `windows` crate for Win32 APIs, and `Paramdex` for game data definitions. The tool is heavily version-dependent, supporting 28 game versions with hardcoded base addresses.
This is the open.mp launcher, a desktop application for browsing and connecting to SA-MP/open.mp multiplayer servers for Grand Theft Auto: San Andreas. Built with Tauri (Rust backend) and a React frontend using react-native-web, it provides a server browser with internet, favorites, and recently joined tabs, real-time server querying via UDP, game process injection, and local settings management. The architecture is a typical Tauri app: the Rust backend handles DLL injection, IPC with the game, deeplink registration, and server querying, while the React frontend manages state with Zustand, provides a custom UI component library, and supports 30+ languages. The application is Windows-only due to heavy reliance on Windows-specific APIs and DLL injection. While functional and feature-rich, the codebase shows signs of technical drift (Tauri v1, multiple Rust crate versions, commented migration code, and fragile file validation logic). It is actively maintained but has medium technical drift risk.
This repository implements a Windows DLL (version.dll) that uses DLL proxy injection to hook into the WeChat desktop client (x64, version 4.1.x). Once injected, it launches a local HTTP server on port 30001 that exposes a REST API for automating WeChat operations: sending text/image/XML messages, forwarding messages, decoding encrypted image caches, querying the user's profile, and executing arbitrary SQL on WeChat's internal SQLite databases (e.g., MicroMsg.db). The architecture is a monolithic DLL with several layers: a proxy DLL loader (version_proxy.cpp), a custom x64 hooking framework (Hook_Method.cpp) using MinHook and assembly trampolines, a set of WeChat interface implementations (wx_send.cpp, wx_send_xml.cpp, etc.) that construct internal WeChat objects using known memory offsets, and an HTTP server (http_server.cpp) built on the vendored cpp-httplib library. The project also includes a database access module (xdb/db_mgr.cpp) that scans WeChat's memory for SQLite3 API routines and executes queries directly, bypassing the need for external database drivers. External dependencies include MinHook (bundled), cpp-httplib (vendored), LZ4 compression library, and nlohmann/json. The code is heavily tied to specific WeChat version offsets and memory layouts, making it fragile across WeChat updates, but the project's update log shows active adaptation to new versions.
This repository is a collection of Proof of Concept (PoC) implementations for various Windows process manipulation and evasion techniques, including process hollowing, DLL injection, spoofing, and memory analysis. Each technique is implemented as a standalone console application with a consistent structure separating command-line handling, core logic, and Windows API interop. The code demonstrates a clear understanding of Windows internals but suffers from significant code duplication (e.g., identical CommandLineParser and HexDump utilities across multiple projects) and relies on undocumented APIs that are prone to breaking with Windows updates. Many techniques are noted in the README as ineffective against modern Windows defenses due to security mitigations. The repository appears to be stale, with no recent updates to address evolving defenses, and exhibits high technical drift due to outdated dependencies and techniques.