WinObjEx64 is a native Windows GUI application that provides deep introspection into the Windows Object Manager namespace and kernel internals. It allows users to browse, view properties, and edit security descriptors for a wide range of NT object types (processes, threads, tokens, sections, ALPC ports, drivers, etc.). The tool also includes 'Extras' dialogs for inspecting system call tables (SSDT), kernel callbacks, unloaded drivers, private namespaces, and more. It relies on a kernel driver (or alternative providers) for reading kernel memory and supports a plugin system for extensibility. Architecturally, the application is a monolith with a plugin subsystem. It uses a custom tree-list control, a lightweight runtime library (minirtl), and a driver provider abstraction layer that supports multiple backends (Microsoft's kldbgdrv, WinIO, custom driver). The codebase is heavily version-aware, with many structures and patterns hardcoded per Windows build (from 7 to 11 25H2). The plugin ABI is well-defined and versioned, allowing third-party plugins to integrate seamlessly. The repository is actively maintained, with recent commits and zero open issues. However, it exhibits medium technical drift due to reliance on undocumented kernel structures, hardcoded byte patterns, and some deprecated Win32 APIs. The code is of high craftsmanship for its niche, with several reusable components that could be extracted for other Windows internals projects.
DSInternals is a comprehensive .NET library and PowerShell module for Active Directory security auditing, forensic analysis, and offline/in-place manipulation of AD databases. It provides the ability to extract password hashes (NT, LM, Kerberos), decrypt DPAPI backup keys, recover LAPS and gMSA secrets, parse FIDO2/Windows Hello key credentials, and query DNS zones and signing keys. The library supports multiple access modes: offline via ESENT/ISAM (ntds.dit), online via RPC replication (DRSR), LDAP/ADSI, and SAM/LSA native APIs. The PowerShell module exposes over 50 cmdlets organized into logical groups (ADDB, ADRepl, ADSI, LSA, SAM, Hash, Encryption). The codebase is heavily oriented toward reverse-engineering of Microsoft's internal AD structures and protocols, with extensive unit tests using real-world binary vectors. While the primary use case is security auditing (e.g., penetration testing, incident response), the library also provides utilities for password quality testing, domain controller recovery, and offline account modifications. The architecture is modular, with clear separation between common data models, data store access, replication, and PowerShell cmdlets, making it a robust toolkit for Windows domain administrators and security professionals.
VxKex is a Windows compatibility layer that enables applications designed for Windows 8, 8.1, and 10 to run on Windows 7 SP1. It achieves this by injecting a core DLL (KexDll) into target processes via Image File Execution Options (IFEO), rewriting import tables to redirect API calls to extended DLLs (KxBase, KxUser, KxCom, KxDx, etc.) that implement missing or modified functions. The project also includes a kernel-mode driver (KexKMSD), a configuration GUI (KexCfg), an installer (KexSetup), a shell extension (KexShlEx), a log viewer (VxlView), and a launcher (VxKexLdr). The codebase is deeply tied to Windows 7 internals, using undocumented NT APIs, assembly syscall hooks, and version spoofing. It is a monolithic collection of tightly coupled C projects built with the Windows 7.1 SDK and custom build utilities. While functionally impressive and demonstrating deep reverse-engineering skill, the code is informal, contains many stubs and TODO comments, and has limited reusability outside its specific context.
This repository, branded as "The Malware Bible," is a curated educational knowledge base for cybersecurity, malware analysis, reverse engineering, and exploit development. It is not a conventional software application or an operational data pipeline; under the available classifications it is closest to data/research because its core assets are reference documentation, course-style Markdown modules, and research-oriented binaries rather than runnable application code. The content is organized into four learning paths: The Beginning (C, Python, x86 assembly, shellcode, reverse engineering basics), The Journey (PE/ELF structures, Android/iOS package formats), The Rituals (obfuscation, evasion, and writing malware), and The Scriptures (tool cheatsheets for radare2, IDA Pro, WinDbg, YARA, WinAPI, and evasion tactics). In practice, the repository serves as a self-study curriculum and analyst reference, not as a deployable system. It includes a large Windows DLL export catalog in Markdown, example ELF binaries demonstrating heap overflow, use-after-free, ROP chains and format string bugs, and numerous screenshots/diagrams. There is no CI/CD, dependency management, or automated testing; several files are marked "Coming soon" or "WORK IN PROGRESS," and external links or sponsor images may rot over time. The Windows API and DLL reference content is broad but may drift as Windows evolves. The last commit is recent, indicating active maintenance, and the repository benefits from a structured table of contents and consistent formatting across chapters.
This repository is a personal study collection focused on Windows internals, combining condensed book notes (Windows Internals 6th/7th ed., Windows System Programming, .NET IL Assembler) with standalone sample code for Windows kernel drivers and user-mode utilities. The code is not a cohesive application but rather multiple independent Visual Studio projects demonstrating key Windows API patterns: WDM driver skeletons (skeleton, dispatch pass-through, IOCTL handling, keyboard filter, file system filter) and user-mode examples (heap enumeration, singly linked lists, Authenticode signature verification). The material is educational in nature, targeting developers and researchers learning Windows kernel-mode programming and system internals. While the code is functional and well-commented, it relies on the older WDM model and some deprecated API patterns, reflecting a ~2017 vintage. The file system filter driver and keyboard filter driver exhibit non-trivial driver engineering patterns that can serve as reusable templates, though they require the Windows Driver Kit to build. No tests, CI, or deployment configurations exist; the repo is purely a reference and learning resource.
This repository is a collection of Proof of Concept (PoC) implementations for various Windows process manipulation and evasion techniques, including process hollowing, DLL injection, spoofing, and memory analysis. Each technique is implemented as a standalone console application with a consistent structure separating command-line handling, core logic, and Windows API interop. The code demonstrates a clear understanding of Windows internals but suffers from significant code duplication (e.g., identical CommandLineParser and HexDump utilities across multiple projects) and relies on undocumented APIs that are prone to breaking with Windows updates. Many techniques are noted in the README as ineffective against modern Windows defenses due to security mitigations. The repository appears to be stale, with no recent updates to address evolving defenses, and exhibits high technical drift due to outdated dependencies and techniques.