WinFsp is a Windows File System Proxy that provides a FUSE (Filesystem in Userspace) compatible API for Windows. It allows developers to create custom file systems in user space using C, C++, .NET, or any language that can call a C library. The repository contains a kernel-mode Windows driver (`src/sys/`) that handles IRP dispatch and communicates with a user-mode DLL (`src/dll/`) via a transaction protocol. It includes a comprehensive FUSE v2 and v3 compatibility layer, a native WinFsp API, a service launcher for running file systems as Windows services, a network provider for automatic mounting, and an extensive test suite. The architecture is a hybrid kernel/user-mode system, deeply integrated with Windows NTFS semantics. While primarily an application framework, it also contains performance benchmarking data and analysis notebooks in its documentation. The codebase is actively maintained, demonstrates high craftsmanship in a difficult domain, and contains several reusable components such as a fault injection framework, POSIX-to-Windows security mapping, and a directory buffer abstraction.
DeepZero is an automated vulnerability research pipeline engine, primarily targeting Windows kernel driver (BYOVD) analysis. It provides a highly concurrent, resumable orchestration framework where pipelines are defined declaratively in YAML. The engine supports stages: ingest, map (parallel analysis), reduce (aggregation), and bulk_map, with built-in fault tolerance, atomic state persistence, and live progress dashboards. It integrates external tools like Ghidra (headless decompilation), Semgrep (static analysis), LIEF (PE parsing), and LLM backends (LiteLLM, Claude Code) for exploitability assessment. The repository includes a full reference pipeline (loldrivers) and multiple language documentation sites. While primarily an application framework, it has strong data research characteristics due to its focus on binary corpus analysis and heuristic/AI assessment.