Awesome Game Security

A low-overhead dynamic binary instrumentation and modification tool for ARM (both AArch32 and AArch64 support) and RISC-V (RV64GC).

Examples for: Learning KVM - implement your own kernel

Unsigned driver loader using CVE-2018-19320

Updated version of System Management Mode backdoor for UEFI based platforms: old dog, new tricks

A Linux framework to enable userspace-defined "Virtual" PCIe card shims to enable in-host PCIe card driver development.

Lua in kernel-mode because why not.

Elden Ring Cheat Engine table maintained by The Grand Archives.

No description.

No description.

Research on Windows Kernel Executive Callback Objects

Process Injection using Thread Name

This repository contains tools to perform modern cache attacks on ARM.

Abyss Engine clean-room reimplementation of Diablo 2, written in C. The goal is to recreate the original game engine, but on a portable platform that can also easily be modded and extended.

Unlocking qualcomm bootloader

Exploits for Android Binder bug CVE-2020-0041

Evading WinDefender ATP credential-theft

Proof of Concepts code for Bring Your Own Vulnerable Driver techniques

Some research on AltSystemCallHandlers functionality in Windows 10 20H1 18999

Android system call hook

An IDA plugin that eases reversing of binaries that have been code-size-optimized with function outlining

No description.

No description.

midgetpack is a multiplatform secure ELF packer

alternative smm driver for ryzen motherboards

一个基于uprobe，能同时hook大量用户地址空间函数的kpm内核模块

Use hardware breakpoints to spoof the call stack for both syscalls and API calls

A Hyper-V Hacking Framework For Windows 10 x64 (AMD & Intel)

Kernel mode bypass for BattlEye, EAC

Free open-source training software / cheat for Counter-Strike: Global Offensive, written in C.

manually map driver for a signed driver memory space

Converted phnt (Native API header files from the System Informer project) to IDA TIL, IDC (Hex-Rays).

Disks for DMA

Chasm Runtime Assembler.

Malware Behavior Analyzer

silent syscall hooking without modifying sys_call_table/handlers via patching exception handler

Simple DLL that spoofs EasyAntiCheat on most games

It's a kernel-based keylogger for Windows x86/x64.

Intercepting DeviceControl via WPP

Analyze Windows x64 Kernel Memory Layout

Simple ELF crypter. Uses RC4 encryption.

The beginning and end of Devilution - Diablo reverse engineered

This x64dbg plugin sets the page protection for memory mapped views in scenarios which cause NtProtectVirtualMemory to fail.

Proof of Concepts code for Bring Your Own Vulnerable Driver techniques

Windows PDB parser for kernel-mode environment.

CE MCP Plugin是一个Cheat Engine插件，它实现了Model Context Protocol (MCP)，允许AI模型与Cheat Engine进行交互。通过这个插件，AI可以使用Cheat Engine的各种功能，如内存读写、进程管理等。

Kasumi - a kernel-level path manipulation and hiding framework

🍂 Android aarch64 kernel driver module providing efficient memory operations, touch simulation and IPC. Features include fast memory remapping.

A zygisk module that dumps so file from process memory

just proof of concept. hooking MmCopyMemory PG safe.

Proof-of-concept kernel driver that hijacks the Windows kernel extension table mechanism to preserve process notify callbacks even when attackers disable standard process notify callbacks.