Gw2 Launchbuddy is a WPF-based Windows application designed as a launcher for the game Guild Wars 2. It provides account management, game launching with custom configurations, plugin support, server selection, crash diagnostics, and cinema mode features. The application follows a modular architecture with distinct managers for accounts, clients, plugins, servers, and environment settings. Key strengths include a well-designed plugin system with clear contracts, robust file operation utilities with retry mechanisms, and reusable window management helpers. The codebase demonstrates practical engineering for a niche gaming utility, though it contains some Windows-specific tight coupling and relies on game-specific APIs that may require maintenance with game updates.
GoPhantom is a Go-based Windows loader generator designed for security research. It creates executables that embed and decrypt payloads and decoy files while employing various evasion techniques to avoid detection. The application takes input files (decoy and payload), encrypts them, generates Go source code using templates that incorporate the encrypted data and selected security features, then compiles this code for Windows/amd64. The resulting executable can showcase the decoy file to the user while executing the payload through techniques like process injection, API hashing, direct syscalls, memory protection evasion, and module stomping to make malicious code appear as legitimate DLL code. The project is explicitly archived and no longer actively developed, as stated in the README.
This repository is a collection of Proof of Concept (PoC) implementations for various Windows process manipulation and evasion techniques, including process hollowing, DLL injection, spoofing, and memory analysis. Each technique is implemented as a standalone console application with a consistent structure separating command-line handling, core logic, and Windows API interop. The code demonstrates a clear understanding of Windows internals but suffers from significant code duplication (e.g., identical CommandLineParser and HexDump utilities across multiple projects) and relies on undocumented APIs that are prone to breaking with Windows updates. Many techniques are noted in the README as ineffective against modern Windows defenses due to security mitigations. The repository appears to be stale, with no recent updates to address evolving defenses, and exhibits high technical drift due to outdated dependencies and techniques.