Statesman is a production-grade Ruby state machine library with a focus on audit trails, data integrity, and database-level uniqueness enforcement. The core is the `Statesman::Machine` module, which provides a declarative DSL (states, transitions, guards, before/after callbacks) and is mixed into a machine class per model. State transitions are persisted as separate transition records (via a pluggable storage adapter), enabling full history and metadata tracking. The library ships with two adapters: an in-memory adapter for testing and an ActiveRecord adapter that uses unique indexes on `sort_key` and `most_recent` columns to prevent duplicate transitions and provide efficient current-state queries. It includes query scopes (`in_state`, `not_in_state`) for ActiveRecord models, a denormalised cached-current-state feature via `ConfigureCachedCurrentState`, and a type-safe variant of the query module for Sorbet compatibility. The codebase is highly modular, well-tested (over 130 spec files across multiple database backends), and follows modern Ruby and Rails best practices. It is maintained by GoCardless and supports Ruby 3.3–4.0 and Rails 7.2–8.1.
Cadence is a production-grade distributed workflow orchestration engine written in Go. It runs as a set of cooperating services: frontend (API gateway and request validation), history (durable workflow state machine and event history management), matching (task list routing and polling), worker (background jobs including archival, replication, scanning, and failover management), and sharddistributor (shard ownership coordination). Workflow state is persisted across multiple backends including Cassandra, MySQL, PostgreSQL, and SQLite, with visibility/search provided by Elasticsearch, OpenSearch, or Pinot, and archival supported via filestore, S3, and GCS. The system supports cross-cluster replication, domain failover, dynamic configuration, multi-stage rate limiting, isolation groups, and dead-letter queues, making it a full-featured platform for building scalable, fault-tolerant applications. Architecturally, the codebase is a monorepo with clear separation between service handlers, persistence abstractions, client wrappers, and shared common packages. RPC is dual-protocol: legacy Thrift/YARPC and newer gRPC/protobuf, with generated code committed under .gen/. Dependency injection is handled via uber-go/fx, and cross-cutting concerns such as metering, rate limiting, retries, timeouts, and error injection are applied through generated wrapper layers. The primary entry points are cmd/server/main.go for the server, cmd/tools/cli/main.go for the admin CLI, cmd/canary/main.go for health canaries, and cmd/bench/main.go for load testing. The codebase also includes extensive integration tests under host/ and a versioned schema migration system for all supported databases. Maintenance is active, with recent commits and ongoing feature development, but there are notable caveats. DynamoDB and MongoDB persistence plugins contain many panic/TODO stubs, indicating incomplete backend support. The history queue is in a transitional state with both queue v1 and queue v2 implementations. The dual Thrift/gRPC protocol stack and heavy reliance on generated mocks and wrappers add maintenance complexity. Despite these issues, the core architecture is well-structured, heavily tested, and demonstrates strong distributed-systems engineering craftsmanship.
Rufus is a Windows-native GUI application for creating bootable USB drives and formatting removable media. In production it is a single binary that drives raw disk I/O through Win32/NT APIs, parses ISO/WIM/VHD/FFU images, decompresses archives in many formats, formats to FAT/FAT32/NTFS/UDF/exFAT/ReFS/ext2/3/4, and writes MBR/PBR/bootloaders such as Syslinux and GRUB. It also implements Windows-specific features such as UEFI Secure Boot revocation updates, Windows To Go support, VSS snapshots, and dark-mode UI. Architecturally it is a classic monolithic C application: an autotools/VS build produces one executable with a Win32 dialog UI, a resource-based localization system, and tightly coupled modules for device enumeration, formatting, ISO mounting, and WIM application. The repo vendors a large collection of self-contained C libraries (wimlib, libcdio, ext2fs, ms-sys, syslinux libinstaller, bled decompression, getopt) and adapts them for Windows raw-block I/O. Runtime dependencies are Windows system DLLs, Microsoft symbol-server downloads, UEFI revocation databases, and optional network fetches of boot components. The project is actively maintained with CI workflows for VS2026 and MinGW, CodeQL, Coverity, and dependabot. Its code quality is characterized by defensive low-level Windows programming, careful handling of version-dependent APIs, and extensive real-hardware compatibility work. The main risk is technical drift: many vendored dependencies are snapshots of older upstream libraries, and several modules rely on undocumented or semi-documented Windows behavior.
AutoRuns is a PowerShell module for live incident response that enumerates Windows autorun artifacts used by legitimate programs and malware to achieve persistence. It scans over 20 categories of autostart execution points (ASEPs) including registry keys (Run, RunOnce, BootExecute, AppInit, etc.), file system locations (Startup folders), scheduled tasks, WMI subscriptions, services and drivers, Office addins, and more. The module provides three main functions: Get-PSAutorun to collect artifacts, New-AutoRunsBaseLine to create a baseline snapshot, and Compare-AutoRunsBaseLine to compare two baselines for change detection. It supports optional file hashing (MD5, SHA1, SHA256) and digital signature verification via Get-AuthenticodeSignature. The architecture is a single PowerShell script module (AutoRuns.psm1) with internal helper functions for registry reading, path normalization, and command-line parsing. It relies solely on PowerShell 4.0+ and Windows built-in APIs, with no external dependencies. The module is designed for forensic analysts and incident responders to quickly identify persistence mechanisms on a live Windows system.
This repository is a lightweight JavaScript library that provides a feature-rich wrapper around the browser's `localStorage` and `sessionStorage` APIs. It offers a unified API for storing, retrieving, and manipulating JSON data, with support for namespacing, multiple storage areas (local, session, page, custom), and a plugin system for extensions. The core module (`src/store2.js`) implements a Store constructor that creates namespace-aware stores, with methods like `get`, `set`, `remove`, `clear`, `each`, `keys`, `transact`, and `add`. It also includes a fake storage fallback for environments where Web Storage is unavailable. The architecture is modular: the core is augmented by optional extension files (e.g., caching, array operations, event handling, cookie backing) that hook into internal methods via `store._`. The library is production-ready, with extensive unit tests and CI via Travis CI (though using Node.js 9, which is outdated). Key entry points are the `store` function and its namespace/area methods, which expose the entire API.
Ventoy is a production-grade tool for creating multi-boot USB drives that can boot ISO, WIM, IMG, VHD(x), and EFI files without reformatting the drive. The system operates by installing a custom bootloader stack onto a USB drive, then at boot time using a modified GRUB2 bootloader to present a menu of available images. When an image is selected, a custom initramfs (cpio archive) containing BusyBox and device-mapper tools is loaded, which creates a virtual block device mapping the image's sectors to the physical disk, allowing the OS to boot as if from a real CD/DVD. The architecture spans multiple layers: a UEFI/BIOS boot chain (GRUB2, iPXE, wimboot, EDK2), a runtime initramfs environment, and host-side installation/configuration tools (Windows GUI, Linux Qt/GTK/WebUI, CLI). It supports x86, x86_64, ARM64, and MIPS64EL architectures, and includes per-distro initramfs hooks for over 100 Linux distributions, Windows, and Unix variants (FreeBSD, DragonFly). External dependencies include heavily modified versions of GRUB2 2.04, EDK2 (stable201911), iPXE, wimboot, squashfs-tools, exfat, and embedded libraries like fat_io_lib and xz-embedded. The project is actively maintained with frequent releases and a large community.
Sled is an embedded key-value store written in Rust that provides ACID transactions, crash safety, and high concurrency. It uses a lock-free architecture based on a lock-free pagecache, lock-free log, and lock-free B+ tree with epoch-based memory reclamation. The database supports multiple keyspaces, watch prefixes, merge operators, and a crash-safe monotonic ID generator. Currently in active development with a major rewrite underway (komora project), it is alpha software with known instability and frequent breaking changes, but demonstrates advanced concurrent data structure techniques.
This is a single-file Obsidian plugin (TypeScript) that automatically persists and restores the cursor position, selection, and scroll offset for every markdown note in a vault. The core logic in main.ts hooks into Obsidian's workspace events (file-open, quit, rename, delete) and uses a polling interval (every 100ms) to detect cursor/scroll changes without relying on global key events. State is stored in a JSON file (configurable, defaults to the plugin directory), with settings for default position on open, save cadence, and pruning rules for orphaned, stale, or excessive entries. The plugin deliberately avoids scrolling when opening a note via a section link by detecting the Obsidian 'is-flashing' CSS marker. Architecturally it is a classic Obsidian plugin: an ES module compiled via Rollup into a single CommonJS bundle, with the settings UI built from the modern SettingGroup API requiring minAppVersion 1.11.0. The main implementation concentrates all feature logic in one 500-line class, relying on Obsidian's private/unstable APIs (marked with @ts-ignore) to read scroll positions and leaf IDs. Data flow is strictly in-memory + async JSON file writes: the path is read from disk at load, pruned, and periodically flushed on a timer (minimum 5s) and on quit. This is not a hybrid research repo; it is a dedicated end-user application plugin. The workmanship exceeds typical plugin boilerplate: the state-comparison logic avoids redundant writes, the pruning layer handles three independent criteria, and the footnote-detection heuristic for the 'before footnotes' option is a genuinely non-obvious feature. However, it is held back by a monolithic design (one giant class), a polling loop instead of event-driven cursor capture, multiple @ts-ignore workarounds against stale Obsidian internals, and a dependency list that is several major versions behind its ecosystem.
This repository is a comprehensive collection of red teaming tactics, techniques, and procedures (TTPs) presented as markdown cheatsheets and guides. It is not a software application or data pipeline; rather, it is a knowledge base containing hundreds of embedded code snippets (bash, PowerShell, Python, Go, Rust, C, etc.) organized by platform (Linux, Windows, macOS, Cloud, ICS, Web). The repo includes a few standalone tools such as an Azure subdomain enumeration Metasploit module, a Flask-based C2 redirector container, a PDF generation script, and a PAM module for credential harvesting. The primary value is as a reference for offensive security operators, not as a runnable application. Architecture is document-based with no API, CLI entry point, or library exports. External dependencies are minimal (mostly system tools).
This repository is a curated list (awesome list) of resources related to malware persistence techniques, tools, and references across multiple platforms (Windows, Linux, macOS, Cloud, Firmware, Databases). It does not contain any executable code, application logic, or data pipelines; it is purely a collection of external links and descriptions organized into categories such as Techniques, Persistence Removal, Detection Testing, Prevention, and Collection. The repository is maintained under the 'awesome' standard with a CI workflow that runs awesome-lint to ensure formatting compliance. It serves as a reference knowledge base for cybersecurity professionals researching persistence mechanisms.