KiFilterFiberContext

warbird-hook. Using Microsoft Warbird to automatically unpack and execute encrypted shellcode in ClipSp.sys without triggering PatchGuard

microsoft-warbird. Reimplementation of Microsoft's Warbird obuscator

promon-reversal. Analysis and proof-of-concept bypass of Promon SHIELD's Android application protection

windows-software-policy. Research on obfuscated licensing APIs / CLIP service in the Windows kernel

warbird-obfuscator. Integration of Microsoft Warbird with the MSVC compiler

VMP3-Disasm. Experimental disassembler for x86 binaries virtualized by VMProtect 3

BadlionLogger. kernel driver used to monitor the activity of BadlionAnticheat.sys by patching its IAT

GD-Editor-Leak. reverse engineered structures and editor code needed to reimplement the editor in the 2019 Geometry Dash 2.2 leaks

photon. Photon is a hooking engine for ARM

ghidra-gdt. Ghidra script for generating Ghidra Data Type (GDT) archives containing type information

x86-Code-Virtualizer. x86 Binary Code Virtualization Tool

SimpleMemoryWrapper. Simple wrapper for the Windows API, its main objective is to document my learning

StudentVue-rs. Unofficial Rust API for StudentVUE

warbirdvm. An analysis of the Warbird virtual-machine protection for the CI!g_pStore

machkit. Mach library wrapper written in C++

VMPROTECT. Obfuscation method using virtual machine.

HEVD-practice. short personal writeups for Hacksys Extreme Vulnerable Driver (HEVD)

psi-secure-admin-unlock. Revealing an undocumented admin control panel in PSI Secure Browser