Michael B.

CallMon. CallMon is an experimental system call monitoring tool that works on Windows 10 versions 2004+ using PsAltSystemCallHandlers

ALPC-Example. An example of a client and server using Windows' ALPC functions to send and receive data.

DynamicKernelShellcode. An example of how x64 kernel shellcode can dynamically find and use APIs

WarbirdExamples. An example of how to use Microsoft Windows Warbird technology

CVE-Stockpile. Master list of all my vulnerability discoveries. Mostly 3rd party kernel drivers.

CVE-2018-16712. PoC Code for CVE-2018-16712 (exploit by MmMapIoSpace)

WHPHook. Simple DLL and client app that work together to hook all the functions in WinHvPlatform.dll in order to provide logging and introspection at the hypervisor level

WhoCalls_C. WhoCalls can query a directory of files, find the binaries, and search for a user specified Win API import. It and works with both 32-bit (PE) and 64-bit (PE32+) file formats (.exe, .dll, .sys)

KLoad_C. A simple command line utility to quickly load and unload Windows drivers

WinPools. WinPools is an example of how Windows kernel big pool addresses can be leaking using NtQuerySystemInformation

DbgKeystone. A keystone engine powered Windows Debugger extension

CVE-2018-15499. PoC code for CVE-2018-15499 (exploit race condition for BSoD)

IOCTL-Flooder. IOCTL-Flooder is a verbose tool designed to help with Windows driver fuzzing by brute forcing IOCTLs on loaded drivers. GetLastError is used to guess validity

FakeDriverPoC. This is a PoC driver which creates a fake driver and device object with the intent on allowing a user mode program to communicate with a "fake" driver and device.

Windows-Syscalls-Examples. Examples of how to use Syscalls in various Windows versions and architectures.

KLoad. A simple command line utility to quickly load and unload Windows drivers

CVE-2018-16713. PoC code for CVE-2018-16713 (exploit by rdmsr)

soplock. The Simple Opportunistic Lock tool

CVE-2018-18714. PoC Code for CVE-2018-18714 (exploit by stack overflow)

CVE-2018-18026. PoC Code for CVE-2018-18026 (exploit by stack overflow)

CVE-2018-16711. PoC code for CVE-2018-16711 (exploit by wrmsr)

HyperCalc. An Intel HAXM powered, protected mode, 32 bit, hypervisor addition calculator, written in Rust.

SHA-ME. A pure WinAPI program that demonstrates translating a file into a SHA-256 hash. Designed to be used as a utility.

Spoof-Task-Manager. An example showing how a mutex can stop taskmgr.exe from loading

The-Good-Bad-Code. Pushing the limits of bad programming practices. Abusing APIs. Destroying utility programs.

Code-Rewrites. Programs and scripts I've ported to other languages, mostly for fun.

wat. The Linux coreutils spin off of cat, but for Windows.

SystemsWork. A repo containing examples relating to various aspects of Windows internals and processor features

Driver-Easy-Research. Python scripts for manipulating Driver Easy's servers

bswap. A Windbg extension for swapping byte endianness.

Check-Administrator-Status. A spin off of Command Prompt Add-ons. This includes examples of how to check privilege status.

AWSTrace. Another Windows Strace PoC

Musical-Processes. Turn a process' memory into music (32-bit only)

mkit. Simple file hiding kernel rootkit for Linux v6

downwithup.github.io. Personal website

WhoCalls. A program which can query a directory of files, find the binaries, and search for a specified Win API import.