GEF (GDB Enhanced Features) is a production-grade GDB plugin for exploit development, reverse engineering, and binary analysis. It is a single Python script (gef.py) that loads into GDB (>=10.0) and provides over 90 commands covering memory inspection, heap analysis, security mitigation checks (checksec), pattern generation, format string detection, and remote debugging. The architecture is monolithic but well-organized, with a clear separation of concerns via class hierarchies for architectures, memory regions, heap structures, and command registration. The test suite is extensive, using a Docker-based CI matrix that runs on multiple architectures (x86, ARM, AARCH64, etc.) and validates behaviour through RPyC-driven remote GDB sessions. While primarily an application, it also serves as a research tool for heap allocator internals and glibc version-specific behaviour, blending practical utility with deep system understanding.
This repository is a comprehensive educational and research resource for low-level systems programming, focusing on Linux kernel modules, baremetal programming, CPU architectures (x86_64, ARM, AArch64), and emulation with QEMU and gem5. It contains hundreds of self-contained examples—from trivial 'hello world' kernel modules to advanced topics like IRQ handling, RCU stalls, inline assembly patterns, CPU pipeline hazards, and floating-point arithmetic. The repository is not a production application but rather a knowledge base with automated build and test infrastructure that systematically verifies correctness across multiple architectures and emulators. It also serves as a reference for gem5 simulation, including checkpoint/restore, performance counters, and benchmarking (e.g., Dhrystone, cache performance). While primarily a research/teaching tool, it includes a reusable Python automation framework (CLI generators, parallel test runners, path-based property configuration) that could be extracted for other projects. The repository is hybrid in nature: its core content is data/research (experimental, analytical), but it incorporates application-quality infrastructure.
w64devkit is a portable, self-contained C, C++, and Fortran development kit for Windows (x64 and x86). It is built entirely from source using a Docker-based multi-stage build system, producing a signed self-extracting 7z archive that requires no installation and runs as any user. The kit includes Mingw-w64 GCC, GDB, GNU Make, CMake, Ninja, BusyBox-w32, Vim, Ctags, Ccache, NSIS, 7-Zip, and a collection of custom utilities (debugbreak, recycle, uuidgen, peports, pkg-config, rexxd, vc++filt, w64devkit launcher). All custom utilities are compiled as tiny, CRT-free executables using -nostartfiles and -nostdlib, linking only kernel32 and custom libraries. The build process applies a curated set of quilt patches to upstream sources to improve Windows compatibility, cross-compilation, and console handling. The repository also includes a full reimplementation of the quilt patch management tool in C++20 (src/quilt.cpp) with built-in diff and patch engines. The codebase demonstrates high craftsmanship in low-level Windows programming, with careful attention to performance (SWAR optimizations, inline assembly), correctness (handling of link.exe bugs, edge cases), and minimal dependencies.