CFB is a ProcMon-style tool designed to assist capturing IRPs sent to Windows drivers.
Appears on
Quick read
Latest capture 2026-10-15 03:13
Archive status reflects the last catalog sync, not a maintenance assessment. Check recent releases, issue responses, and fit for your project with the repository shortlisting checklist.
0 paths
Agent instructions and tool configuration found in this repository.
No config files detected.
5 observed captures since 2026-06-24. Observed captures are shown by default.
Stars from first capture +4
Observed captures only
All tracked data
Observed snapshots
Observed snapshots
Nearest indexed repositories by embedding similarity.
Static analysis & exploitation-triage toolkit for Windows kernel drivers. Discover IOCTLs, Symbolic Links, and check cert , and Downlaods BYOVD
⚡ Automatically decrypt encryptions without knowing the key or cipher, decode encodings, and crack hashes ⚡
It's pointy and it hurts!
Enumerating and removing kernel callbacks using signed vulnerable drivers
Macro-header for compile-time C polymorphic obfuscation (tcc, win x86/x64)
TCP/IP packet demultiplexer. Download from:
