HyperDbg

HyperDbg Debugger HyperDbg Debugger is an open-source, hypervisor-assisted debugger for Windows Linux support is currently under development! with support for both user-mode and kernel-mode native debugging. It is built for reverse engineering, fuzzing, and advanced system analysis using modern...

CVE-2026-20805-POC

CVE-2026-20805 PoC Proof of concept for the information disclosure vulnerability in Microsoft's Desktop Window Manager dwm.exe. 📋 Vulnerability Summary ID: CVE-2026-20805 Product: Microsoft Windows Component: Desktop Window Manager dwm.exe CWE-ID: CWE-200 Exposure of Sensitive Information to an...

winfsp

WinFsp · Windows File System Proxy WinFsp enables developers to write their own file systems i.e. "Windows drives" as user mode programs and without any knowledge of Windows kernel programming. It is similar to FUSE Filesystem in Userspace for Linux and other UNIX-like computers. winfsp.dev...

GhostKatz

GhostKatz Extract LSASS credentials directly from physical memory by abusing signed vulnerable drivers with physical memory read primitives via MmMapIoSpace, bypassing traditional user-mode detection capabilities. This tool was developed in collaboration between Julian Peña and Eric Esquivel. Thi...

EDR-Freeze

EDR-Freeze This is a tool that exploits the software vulnerability of WerFaultSecure to suspend the processes of EDRs and antimalware without needing to use the BYOVD Bring Your Own Vulnerable Driver attack method. EDR-Freeze operates in user mode, so you don't need to install any additional...

ring3-kit

ring3-kit Hides Process From Task Manager Using NT Hooking NtQuerySystemInformation. A simple Ring-3 user mode rootkit. How Hook the API function NtQuerySystemInformation with our own function that hides a process from task manager Hooked function gets called instead The DLL is injected into...

DMA-ProcessDumper

DMA-ProcessDumper Dumps entire memory of target process on the user-mode using DMA with MemProcFS over a PCIe FPGA device Building Copy leechcore.h, vmmdll.h and vmm.lib from MemProcFS into the DMA-ProcessDumper directory Compile using Visual Studio Copy leechcore.dll, vmm.dll and FTD3XX.dll from...

TelemetrySourcerer

Telemetry Sourcerer Introduction Telemetry Sourcerer can enumerate and disable common sources of telemetry used by AV/EDR on Windows. Red teamers and security enthusiasts can use this tool in a lab environment to: Identify collection-based blind spots in the products they're up against. Determine...

DrSemu

Dr.Semu Dr.Semu runs executables in an isolated environment, monitors the behavior of a process, and based on Dr.Semu rules created by you or the community, detects if the process is malicious or not. The tool is in the early development stage whoami: @qazqaz With Dr.Semu you can create rules to...

CVE-2026-43499-S25U

CVE-2026-43499 PoC for Galaxy S25 Ultra Device-specific proof of concept for CVE-2026-43499 on the Korean Samsung Galaxy S25 Ultra. Supported target Model: SM-S938N Codename: pa3q Android: 16 / API 36 Build: S938NKSUACZF1 Display ID: BP4A.251205.006.S938NKSUACZF1 Fingerprint:...

CVE-2026-50416-writeup-and-poc

CVE-2026-50416: a kernel address in the desktop heap On the affected system, this read from the user mapping of the Win32 desktop heap returned a kernel address: ULONG64 leaked = ULONG64 desktopheap + 0x100; That is the whole disclosure. At first it was only an eight-byte value with convincing hi...

CVE-2011-1237

CVE-2011-1237 This is an old POC for CVE-2011-1237 on Windows 7 written in 2013. The vulnerability was discovered by Tarjei Mandt @kernelpool and explain in his paper Kernel Attacks through User-Mode Callbacks. Several things are hardcoded in this POC and it call the Null page which does not work...

CVE-2024-38041

CVE-2024-38041 Kernel pointers copied to output user mode buffer with ioctl 0x22A014 in the appid.sys driver...

CVE-2025-7771

CVE-2025-7771 Exploit to invoke arbitrary kernel-mode functions from usermode by abusing ThrottleStop driver. Demonstration References https://github.com/jonomango/superfetch https://securelist.com/av-killer-exploiting-throttlestop-sys/117026/...

WiseDelete

WiseDelfile Driver Wrapper A lightweight Windows utility that loads the WiseDelfile64.sys kernel driver, performs the required device handshake, and issues IOCTL requests to delete files that cannot be removed through standard Windows APIs. This project demonstrates how CVE-2025-66680 , can be us...

CVE-2026-90834

The user-mode syscall verifiers for the 16-bit "wide data" UART API in drivers/serial/uarthandlers.c validated the wrong driver operation. zvrfyuartpolloutu16, zvrfyuarttxu16 and zvrfyuartrxenableu16 each ran KSYSCALLDRIVERUART against the 8-bit op pollout, tx, rxenable rather than the 16-bit op...

CVE-2026-90834

The user-mode syscall verifiers for the 16-bit "wide data" UART API in drivers/serial/uarthandlers.c validated the wrong driver operation. zvrfyuartpolloutu16, zvrfyuarttxu16 and zvrfyuartrxenableu16 each ran KSYSCALLDRIVERUART against the 8-bit op pollout, tx, rxenable rather than the 16-bit op...

CVE-2026-90833

The simulated EEPROM driver in the Zephyr RTOS (specifically drivers/eeprom/eeprom_simulator.c) contains a logic flaw in eeprom_range_is_valid(). The function fails to properly validate the offset argument because it performs an addition of a signed off_t and an unsigned size_t using unsigned ari...

CVE-2026-90833 Signed offset bypasses bounds check in simulated EEPROM driver, allowing out-of-bounds kernel memory read and write from user mode

The simulated EEPROM driver validated access ranges in eepromrangeisvalid drivers/eeprom/eepromsimulator.c with a single test, offset + len size. Because offset is a signed offt and len an unsigned sizet of the same rank, the addition is evaluated in unsigned arithmetic: a negative offset combine...

sinter

Sinter Sinter is a 100% user-mode endpoint security agent for macOS 10.15 and above, written in Swift. Sinter uses the user-mode EndpointSecurity API to subscribe to and receive authorization callbacks from the macOS kernel, for a set of security-relevant event types. The current version of Sinte...