This repository contains a Linux kernel driver for managing battery health features on Acer laptops via the WMI (Windows Management Interface) interface. The driver enables control of two key battery functions: a health mode that limits charge to 80% to prolong battery lifespan, and a calibration mode that performs a full charge-discharge cycle for accurate capacity reporting. It also provides battery temperature readings. Implemented as a single kernel module (acer-wmi-battery.c), it interacts with the laptop's firmware through WMI methods to query and set battery parameters, exposing these controls via sysfs attributes under /sys/bus/wmi/drivers/acer-wmi-battery/. The driver follows standard Linux kernel module practices, including proper error handling, version-dependent includes for compatibility, and sysfs attribute creation for user-space interaction. It includes reusable WMI helper functions that encapsulate the boilerplate for WMI method calls, buffer handling, and response validation. The project is actively maintained with recent commits, supports multiple Acer laptop models as documented in MODELS.md, and is licensed under GPL-2.0.
This repository is a personal study collection focused on Windows internals, combining condensed book notes (Windows Internals 6th/7th ed., Windows System Programming, .NET IL Assembler) with standalone sample code for Windows kernel drivers and user-mode utilities. The code is not a cohesive application but rather multiple independent Visual Studio projects demonstrating key Windows API patterns: WDM driver skeletons (skeleton, dispatch pass-through, IOCTL handling, keyboard filter, file system filter) and user-mode examples (heap enumeration, singly linked lists, Authenticode signature verification). The material is educational in nature, targeting developers and researchers learning Windows kernel-mode programming and system internals. While the code is functional and well-commented, it relies on the older WDM model and some deprecated API patterns, reflecting a ~2017 vintage. The file system filter driver and keyboard filter driver exhibit non-trivial driver engineering patterns that can serve as reusable templates, though they require the Windows Driver Kit to build. No tests, CI, or deployment configurations exist; the repo is purely a reference and learning resource.
RedEdr is a Windows telemetry recorder designed for red teams and malware developers to assess detection surface before hitting a real EDR. It captures events from multiple Windows security layers: ETW (Event Tracing for Windows), ETW-TI (Threat Intelligence), kernel callbacks, and user-mode API hooks via Detours. The system comprises a main orchestrator (RedEdr.exe) that starts all reader subsystems, a kernel driver (RedEdrDriver.sys) for process/thread/image callbacks and KAPC injection, a DLL (RedEdrDll.dll) injected into target processes for ntdll.dll hooking, and a PPL service (RedEdrPplService.exe) that consumes ETW-TI events. An embedded web server (port 8081) serves a REST API and a client-side log viewer for filtering and analyzing captured events. The architecture follows a producer-consumer pattern: events from all sources (ETW, kernel pipe, DLL pipe, PPL pipe) are aggregated into a central EventAggregator, augmented with process and memory context, and then stored for retrieval via the web API. Inter-component communication relies on named pipes with simple ASCII command protocols. The kernel driver also includes an ELAM driver to allow the PPL service to run as a protected process. While the project demonstrates deep Windows internals knowledge and provides a comprehensive telemetry capture system, it has significant maintenance risks: hardcoded paths (C:\RedEdr\), fragile driver build dependencies, minimal unit test coverage, and several commented-out hooks in the injected DLL. The codebase is functional for its intended red-team use case but is not production-grade without substantial hardening.
This repository provides two Windows desktop applications (WiinUPro and WiinUSoft) that allow users to connect Nintendo controllers (Wiimote, Nunchuk, Classic Controller, Pro Controller, Joy-Con, GameCube) and PlayStation controllers (DS3, DS4) to a PC, emulating Xbox 360 controllers (XInput) or other outputs like keyboard/mouse and vJoy virtual joystick. The architecture is a hybrid of C# WPF applications, a C++ kernel-mode virtual bus driver (ScpVBus.sys), and a C++ XInput wrapper DLL. The core logic is split into several libraries: NintrollerLib for parsing Nintendo controller protocols, ScpControl for Bluetooth/USB communication with PS3/PS4 controllers, and a Shared project with common utilities. The applications feature interactive controller visualizations, calibration tools, profile management, and localization support. The codebase is functional but shows signs of organic growth and technical debt. There are two overlapping applications (WiinUPro and WiinUSoft) with similar functionality, suggesting an incomplete migration. The kernel driver is provided as a precompiled binary without source, and the project targets .NET Framework 4.0 with legacy dependencies like SharpDX. Hardcoded magic numbers, commented-out code, and TODO comments are prevalent. Despite these issues, the repository demonstrates deep knowledge of controller protocols and provides a working solution for a niche use case. It is maintained sporadically by a single developer, with the last commit dated 2026-05-07 (likely a placeholder).