WinObjEx64 is a native Windows GUI application that provides deep introspection into the Windows Object Manager namespace and kernel internals. It allows users to browse, view properties, and edit security descriptors for a wide range of NT object types (processes, threads, tokens, sections, ALPC ports, drivers, etc.). The tool also includes 'Extras' dialogs for inspecting system call tables (SSDT), kernel callbacks, unloaded drivers, private namespaces, and more. It relies on a kernel driver (or alternative providers) for reading kernel memory and supports a plugin system for extensibility. Architecturally, the application is a monolith with a plugin subsystem. It uses a custom tree-list control, a lightweight runtime library (minirtl), and a driver provider abstraction layer that supports multiple backends (Microsoft's kldbgdrv, WinIO, custom driver). The codebase is heavily version-aware, with many structures and patterns hardcoded per Windows build (from 7 to 11 25H2). The plugin ABI is well-defined and versioned, allowing third-party plugins to integrate seamlessly. The repository is actively maintained, with recent commits and zero open issues. However, it exhibits medium technical drift due to reliance on undocumented kernel structures, hardcoded byte patterns, and some deprecated Win32 APIs. The code is of high craftsmanship for its niche, with several reusable components that could be extracted for other Windows internals projects.

WDExtract is a command-line utility for extracting and analyzing Windows Defender/Virus Definition files. It processes VDM (Virus Definition Module) containers and MRT.exe (Malicious Removal Tool) files to extract embedded data, including PE executables, DLLs, and security signatures. The tool can also merge base VDM files with their delta updates and extract raw RMDX containers without further processing. Built with C++ and Windows API, it uses zlib for decompression and implements custom logic for parsing PE files, applying VCDIFF delta patches, and extracting resources from PE files. The application is actively maintained with recent commits and uses GitHub Actions for Windows-based builds.