docs: add new repository link for enhanced syscall tracing to README.md

2026-06-21 13:56:22 +00:00 · 2026-06-20 00:11:51 +08:00
parent deda2b2517
commit 3ef3c62896
124 changed files with 124 additions and 0 deletions
@@ -0,0 +1 @@
 Codex skills for generating game-ready 2D sprites and layered maps using AI image generation, with local post-processing pipelines that clean, split, validate, and export assets for Godot, Unity, or raw 2D workflows.
@@ -0,0 +1 @@
 A Windows driver static analysis and bug hunting tool that performs IOCTL dispatch recovery, taint analysis, emulation-based handler tracing, certificate verification, YARA scanning, and PoC generation to find vulnerabilities in kernel drivers.
@@ -0,0 +1 @@
 A polymorphic mutation engine for mimikatz that uses disassembly, CFG analysis, instruction-level morphing (register renaming, junk insertion, equivalent substitution), and data-flow obfuscation to generate unique variants that evade signature-based detection.
@@ -0,0 +1 @@
 A Rust-based binary auditing tool that locates calls to potentially insecure functions (strcpy, sprintf, system, ioctl, etc.) in compiled binaries to identify candidate vulnerability points for manual review.
@@ -0,0 +1 @@
 A C++/Rust/Python library that wraps Ghidra's native decompiler (SLEIGH + Pcode) for headless binary analysis, providing APIs for disassembly, decompilation, CFG construction, type system manipulation, and cross-reference queries without a JVM.
@@ -0,0 +1 @@
 An ETW-based process monitoring system with a kernel driver that collects thread creation, image load, and memory allocation events, paired with a user-mode analysis engine to detect suspicious behaviors like injection and hollowing.
@@ -0,0 +1 @@
 A proof-of-concept tool that detects stack spoofing in CET-enabled processes by comparing the hardware shadow stack against the user-mode call stack to identify missing or mismatched frames.
@@ -0,0 +1 @@
 Research project analyzing EasyAntiCheat's Linux userland module, including VM-based obfuscation handler tracing, dispatch table recovery, GDB-assisted dynamic analysis, and control-flow deobfuscation of EAC's protected code.
@@ -0,0 +1 @@
 A pipeline-driven identity sanitization framework that strips PII, hardware fingerprints, and telemetry artifacts from machines through configurable YAML-defined cleaning stages with extensible custom pipeline support.
@@ -0,0 +1 @@
 A .NET-based binary analysis and emulation framework using Unicorn Engine that supports x86/x64/ARM Windows and Linux binaries, providing syscall emulation, PE/ELF loading, API hooking, and configurable analysis for reverse engineering.
@@ -0,0 +1 @@
 A Linux kernel module for Android that hides root access by hooking syscalls, VFS operations, and proc filesystem via ftrace and tracepoints, spoofing mount info, SELinux context, and file attributes to bypass root detection.
@@ -0,0 +1 @@
 Automated kernel build scripts for OPPO/OnePlus/Realme Snapdragon 8 Elite (SM8750) and Dimensity 9400+ (MT6991) devices, supporting both OKI and GKI compilation modes with f2fs compatibility patches and KernelSU integration.
@@ -0,0 +1 @@
 A collection of Windows kernel driver exploits including AMD uProf arbitrary file write (CVE-2025-61969), kernel write (CVE-2026-0466), ASIO64 driver exploitation, and MS-BKRP padding oracle decryption.
@@ -0,0 +1 @@
 A collection of BepInEx utility plugins for IL2CPP Unity games, providing fullscreen toggle, window resize, graphics settings, mute-in-background, message center overlay, and other runtime tweaks.
@@ -0,0 +1 @@
 A C/C++ 3D rendering library built on top of raylib, adding PBR materials, deferred/forward rendering, shadow mapping, SSAO, bloom, decals, skeletal animation, particle systems, and a full OpenGL-based render pipeline.
@@ -0,0 +1 @@
 A Call of Duty: Modern Warfare 2 (2009) client modification framework featuring Arxan anti-tamper bypasses, code healing, integrity check neutralization, custom console, server emulation, and modding infrastructure.
@@ -0,0 +1 @@
 A lightweight ARM64 kernel inline hook framework for Android that supports full instruction relocation (B/BL/ADRP/LDR literal/CBZ/TBZ etc.), 64-bit long jumps via trampoline, and automatic WP/memory permission bypass.
@@ -0,0 +1 @@
 A Lua bytecode decompiler written in Pascal supporting Lua 5.1 through 5.5, with SSA-based analysis, control flow reconstruction, boolean expression recovery, and support for custom opcode tables used by game-modified Lua VMs.
@@ -0,0 +1 @@
 An x64dbg plugin that parses DWARF debug information from ELF/PE binaries using libdwarf, importing function names, variable types, and source line mappings into the x64dbg debugger.
@@ -0,0 +1 @@
 A process-independent virtual machine code obfuscation engine that lifts x86/x64 instructions into a custom IR, generates polymorphic VM bytecode with encrypted handlers, and embeds the VM dispatcher into PE executables.
@@ -0,0 +1 @@
 Documentation and scripts for cloning PS4/PS5 extended storage drives using dd and sparse images on Linux, enabling transfer of installed applications between consoles via drive imaging.
@@ -0,0 +1 @@
 An Android application for running virtual machines on-device using QEMU/KVM and Qualcomm Gunyah hypervisor, supporting ARM64 and x86_64 guest OS images with VNC display and console management.
@@ -0,0 +1 @@
 An IDA Pro processor module and loader for Zeus VM custom bytecode, supporting 69 instructions with XOR key chain decryption, cross-references for branch targets, and auto-comments for instruction semantics.
@@ -0,0 +1 @@
 Epic Games' open-source Rust-based version control system designed for large-scale game development, featuring content-defined chunking, cloud-native storage backends, and efficient handling of large binary assets.
@@ -0,0 +1 @@
 A powerful static binary rewriting tool for x86_64 Linux ELF binaries that can insert jumps, trampolines, and instrumentation at any instruction without reassembly, using instruction punning and eviction techniques.
@@ -0,0 +1 @@
 A comprehensive game optimization reference covering Unity and Unreal Engine performance profiling, console hardware specs and PC equivalents, rendering pipeline optimization, and engine-specific tooling guides.
@@ -0,0 +1 @@
 A custom C++ game engine built with Vulkan rendering, featuring a render graph, PBR materials, cascaded shadow maps, GTAO, skeletal animation with GPU skinning, ECS scene management, fiber-based job system, and an integrated editor.
@@ -0,0 +1 @@
 Hex-Rays' Rust-based multi-architecture CPU emulator supporting x86, x64, ARM32, and AArch64 with JIT compilation, designed for binary analysis, fuzzing, and integration with IDA Pro decompilation workflows.
@@ -0,0 +1 @@
 A Nintendo 3DS emulator written in C++ with ARM9/ARM11 and Teak DSP interpreter cores, HLE/LLE audio, hardware-accelerated GPU rendering, and cross-platform support for Windows, macOS, Linux, and Android.
@@ -0,0 +1 @@
 A Python CLI companion for IDA Pro that connects to running IDA instances via a worker plugin, providing commands for disassembly, cross-references, type queries, memory reads, and annotation directly from the terminal.
@@ -0,0 +1 @@
 A collection of Rust-based Windows persistence and evasion tools using bind links, ID mapping, cloud file sync providers, and WIM hash manipulation for stealthy post-exploitation techniques.
@@ -0,0 +1 @@
 A Rust-based SMT solver server for QF_BV (quantifier-free bitvector) logic with SMT-LIB 2 parsing, bit-blasting to SAT, and C++/Python client libraries for integration with binary analysis and deobfuscation tools.
@@ -0,0 +1 @@
 An Android app that exploits app zygote services to inject permissive SELinux policy rules at runtime without requiring root or kernel modifications, demonstrating SEPolicy manipulation via AIDL service binding.
@@ -0,0 +1 @@
 A tool that patches ELF binary GOT (Global Offset Table) entries to redirect function calls, injecting custom shellcode for hooking shared library functions in ARM/ARM64 Android native binaries.
@@ -0,0 +1 @@
 A polymorphic PE packer/crypter engine with mutation capabilities including junk code insertion, instruction substitution, XTEA encryption, RunPE process hollowing, stack spoofing, module stomping, and Hell's Gate syscall invocation.
@@ -0,0 +1 @@
 An iOS tool that uses the bl_sbx exploit to suppress call-recording notification sounds, allowing silent call recording by replacing system audio assets on jailbroken devices.
@@ -0,0 +1 @@
 A comprehensive Windows anti-debugging library in C implementing multiple detection techniques including API-based checks, timing attacks, process environment queries, hardware breakpoint detection, exception-based tricks, and direct syscall evasion.
@@ -0,0 +1 @@
 A pipeline for generating 3D assets from text descriptions using AI image generation and Trellis 3D reconstruction, with cloud inference support (Modal/Replicate/RunPod) and export to GLB/USDZ/STL formats.
@@ -0,0 +1 @@
 A game anti-cheat system using a DLL injected into the game process that performs YARA signature scanning, call stack validation, hardware breakpoint monitoring, and named pipe IPC for reporting detected cheats to a backend service.
@@ -0,0 +1 @@
 A decompilation of the Retro Engine (RSDKv5/v5U) used by Sonic Mania and other Retro Engine games, providing cross-platform support with modding API, multiple audio/rendering backends, and legacy engine compatibility.
@@ -0,0 +1 @@
 A .NET-based debugger for Windows Isolated User Mode (IUM/Trustlet) processes that uses Hyper-V hypercalls to read/write trustlet memory and disassemble protected code running in VSM secure enclaves.
@@ -0,0 +1 @@
 A Windows tool that scans process memory regions using VirtualQueryEx to find RWX (Read-Write-Execute) memory pages suitable for code injection, returning addresses of exploitable memory regions.
@@ -0,0 +1 @@
 A Windows shellcode loader using fiber-based execution, JIT decryption, custom cipher routines, and WinHTTP staging to download and execute payloads with manual API resolution via PEB walking.
@@ -0,0 +1 @@
 A native C++ disassembler and decompiler with multi-architecture support (x86/x64/ARM/AArch64), featuring CFG analysis, FLIRT signatures, PDB loading, BinDiff comparison, RTTI recovery, packer detection, Lua scripting, and an ImGui-based UI.
@@ -0,0 +1 @@
 A direct syscall invocation technique for Windows x64 that resolves syscall numbers at runtime from ntdll and executes them via inline assembly, bypassing user-mode API hooks for evasion.
@@ -0,0 +1 @@
 A Rust-based static analysis framework providing multi-language support with abstract interpretation, points-to analysis, taint tracking, call graph construction, and SARIF/HTML report export for vulnerability detection in compiled binaries.
@@ -0,0 +1 @@
 A Call of Duty: Black Ops dedicated server reimplementation based on leaked source code, including DemonWare networking stack, zone/asset loading, and game server infrastructure for community hosting.
@@ -0,0 +1 @@
 A comprehensive fix and enhancement mod for GTA IV and Episodes from Liberty City that patches rendering bugs, improves graphics quality, fixes gameplay issues, and adds configurable visual settings through ASI plugin injection.
@@ -0,0 +1 @@
 A Rust-based PUBG external cheat framework using kernel driver communication for memory read/write, featuring player ESP, radar, and process protection bypass through CR3 manipulation and keyboard/mouse input injection.
@@ -0,0 +1 @@
 An Android risk detection SDK that identifies rooted devices, emulators, hooking frameworks (Frida/Xposed), debuggers, VPN connections, and other security threats through native JNI checks and system property analysis.
@@ -0,0 +1 @@
 A Windows kernel driver that suppresses blue screen crashes (BSODs) by hooking bugcheck callbacks and performing SEH-based recovery under HVCI, using CET-compatible assembly stubs to survive kernel exceptions.
@@ -0,0 +1 @@
 A Grafana vulnerability scanner that checks for multiple CVEs (path traversal, SSRF, auth bypass, information disclosure) with parallel scanning, authentication support, and HTML/CSV/JSON report generation.
@@ -0,0 +1 @@
 A standalone native decompiler engine extracted from Ghidra's SLEIGH/Pcode framework, reimplemented in C++ with BFD integration for multi-architecture binary analysis without requiring Java or the full Ghidra installation.
@@ -0,0 +1 @@
 A Godot Engine plugin that enables platform-specific resource remapping, allowing developers to swap textures, audio, scenes, and other assets per target platform (Windows, Android, iOS, Web) during export.
@@ -0,0 +1 @@
 A WebAssembly-compiled Ghidra decompiler that runs entirely in the browser, providing binary decompilation for multiple architectures without server-side processing using the SLEIGH framework compiled to WASM.
@@ -0,0 +1 @@
 A Rust game hacking library for Windows providing inline/IAT/VMT/VEH/hardware breakpoint hooks, memory manipulation, PE parsing, PEB walking, process/thread hijacking, DirectX overlay rendering, and math utilities for cheat development.
@@ -0,0 +1 @@
 A proof-of-concept exploit for a Qualcomm Android Verified Boot (AVB) vulnerability that bypasses boot image verification through crafted partition data to achieve persistent code execution on Qualcomm-based devices.
@@ -0,0 +1 @@
 A Rust-based multi-architecture binary analysis toolkit supporting ARM64, x86-64, ELF, Mach-O, DEX, and PE formats, with disassembly, CFG construction, cross-references, pattern matching, and binary patching capabilities.
@@ -0,0 +1 @@
 An IDA Pro RPC server plugin that exposes IDA's analysis capabilities (disassembly, decompilation, cross-references, patching, type system) over a network protocol, enabling remote scripting and AI agent integration.
@@ -0,0 +1 @@
 An IL2CPP dumper extension that generates PDB debug symbol files from IL2CPP metadata, mapping method addresses and type information back to original .NET symbols for debugger integration.
@@ -0,0 +1 @@
 A cross-platform transparent proxy and network interception tool written in Go, using eBPF on Linux for traffic redirection, with TUN-based routing and DNS manipulation for network security testing.
@@ -0,0 +1 @@
 A binary-to-source analysis tool that uses IDA Pro or radare2 backends to decompile functions, cluster them by similarity, generate meaningful names, and export structured analysis results with Semgrep rule integration.
@@ -0,0 +1 @@
 A lightweight Linux process tracer using ptrace that attaches to running processes or spawns new ones, decodes x86_64 syscalls with argument inspection, and supports remote tracing via TCP socket connections.
@@ -0,0 +1 @@
 A web-based viewer for Windows kernel structures (ntoskrnl, hal, etc.) that displays functions, types, constants, IRQL annotations, and type relationship graphs with search, filtering, and dataset switching.
@@ -0,0 +1 @@
 A Python toolkit for reconstructing manually-mapped PE images from process memory, including deep PE scanning, contiguous memory dumping, headerless PE rebuilding, hook analysis, and export table resolution.
@@ -0,0 +1 @@
 A Python-based Dalvik virtual machine emulator that executes DEX bytecode with opcode interpretation, class loading, Android API mocking, static analysis, and dependency tracing for Android malware analysis and reverse engineering.
@@ -0,0 +1 @@
 A Windows TPM measured boot analysis and remote attestation tool that parses TCG event logs, verifies PCR values, analyzes WBCL boot policy, and performs EK/AK-based remote attestation with security feature reporting.
@@ -0,0 +1 @@
 Scripts to integrate Magisk root and Google Apps (GApps) into Windows Subsystem for Android (WSA) locally, enabling rooted Android environment with Play Store support on Windows 11.
@@ -0,0 +1 @@
 A kernel driver mapper that exploits the PdFwKrnl.sys (BitLocker) driver vulnerability to bypass Driver Signature Enforcement (DSE) and map unsigned drivers into kernel space via SeValidateImageData/Header patching.
@@ -0,0 +1 @@
 An exploit for the PdFwKrnl.sys (BitLocker) driver vulnerability that achieves arbitrary kernel code execution by abusing the driver's IOCTL interface to load and execute unsigned kernel code.
@@ -0,0 +1 @@
 A tool that exploits the Qualcomm QCI0701 ACPI driver (QIOMem.sys) by creating a virtual software device to gain access to physical memory read/write primitives through the driver's IOCTL interface.
@@ -0,0 +1 @@
 An Android port of the yuzu Nintendo Switch emulator, providing ARM64 JIT recompilation, Vulkan/OpenGL rendering, and full Switch game compatibility on Android devices.
@@ -0,0 +1 @@
 A minimal Windows PE loader that manually maps executables into memory, resolves imports, applies relocations, and executes the entry point without using the standard Windows loader APIs.
@@ -0,0 +1 @@
 A Rust-based Game Boy and Game Boy Color emulator with cycle-accurate CPU, PPU, and APU emulation, wgpu-based rendering, and a desktop GUI application for game library management and playback.
@@ -0,0 +1 @@
 An open-source implementation of the Petya ransomware bootloader for educational purposes, featuring MBR replacement, NTFS encryption with Salsa20, custom bootloader with keyboard input, and key derivation functions.
@@ -0,0 +1 @@
 A Cobalt Strike Beacon Object File (BOF) that monitors USB device insertion/removal events on Windows using WM_DEVICECHANGE messages, reporting connected USB devices back to the operator.
@@ -0,0 +1 @@
 A web-based tool for browsing, comparing, and diffing Windows ETW (Event Tracing for Windows) provider manifests across different OS versions, with snapshot tracking and change visualization.
@@ -0,0 +1 @@
 An MCP (Model Context Protocol) server that bridges GDB to AI assistants, enabling LLMs to control GDB debugging sessions with commands for breakpoints, memory inspection, register reads, and stepping through code.
@@ -0,0 +1 @@
 A Go-based Windows kernel driver static analysis tool that parses IDA/Ghidra exports to identify IOCTL handlers, access check gaps, ALPC issues, COM vulnerabilities, and unsafe native API usage patterns with configurable rules.
@@ -0,0 +1 @@
 A Go-based PE binary analysis and reverse engineering tool with x86/x64 disassembly, CFG construction, decompilation, entropy analysis, string extraction, import/export analysis, YARA scanning, and a web-based UI.
@@ -0,0 +1 @@
 A Windows kernel pool memory diffing toolkit with a kernel driver that snapshots pool allocations and a user-mode Go tool that compares snapshots to detect new allocations, useful for finding kernel object leaks and forensics.
@@ -0,0 +1 @@
 A Windows kernel-level live debugging toolkit with a kernel driver for memory inspection, module enumeration, disassembly via Zydis, and a user-mode CLI for interactive kernel debugging without requiring a traditional kernel debugger setup.
@@ -0,0 +1 @@
 An open-source game testing and debugging framework with agent-driven test automation, protocol-based seed evolution, diagnostic loops, and generalization capabilities for automated game QA workflows.
@@ -0,0 +1 @@
 An ARM64/AArch64 ELF packer and in-memory loader for Linux that encrypts executables, generates custom stub code, and performs fileless execution via memfd_create for evasion.
@@ -0,0 +1 @@
 A circuit-based SAT solver that operates directly on AIG (And-Inverter Graph) representations, using circuit-aware reasoning with AIGER format support for hardware verification and combinational equivalence checking.
@@ -0,0 +1 @@
 A 3D web application built with React and Three.js that renders interactive panoramic image worlds with spatial audio, animated butterflies, touch controls, and world-switching via a sidebar interface.
@@ -0,0 +1 @@
 A multi-format binary analysis tool written in C supporting PE, ELF, Mach-O, DEX, APK, and ARM disassembly, with file structure parsing, opcode decoding, and cross-platform command-line interface.
@@ -0,0 +1 @@
 An x64 code virtualization obfuscator that translates native instructions into custom VM bytecode with polymorphic handlers, junk code insertion, register mapping, PDB-guided function selection, and PE section rewriting.
@@ -0,0 +1 @@
 An exploit for CVE-2025-21333, a Windows Hyper-V virtualization stack heap-based buffer overflow vulnerability, achieving local privilege escalation through IoRing-based pool spraying and pipe attribute arbitrary read/write primitives.
@@ -0,0 +1 @@
 An AI-driven PoC (Proof of Concept) exploit generation framework that uses LLM agents with MCP tools to automatically analyze CVEs, compile test code, and iteratively develop working exploits with budget tracking and reporting.
@@ -0,0 +1 @@
 A privilege escalation exploit for CVE-2026-40369, an arbitrary kernel address increment vulnerability in NtQuerySystemInformation (class 253) on Windows 11 24H2-25H2, reachable from Chrome sandbox with 100% reliability.
@@ -0,0 +1 @@
 A web-based 3D Gaussian Splatting editor built on PlayCanvas engine for viewing, editing, and optimizing 3D Gaussian splat scenes with selection tools, animation tracks, camera poses, and PLY/splat export.
@@ -0,0 +1 @@
 A PS5 Linux loader that exploits kernel and hypervisor vulnerabilities to boot Linux on PlayStation 5, with IOMMU setup, GPU initialization, hypervisor defeat shellcode, and TMR (Trusted Memory Region) handling.
@@ -0,0 +1 @@
 A Windows game modding framework that injects a JavaScript runtime (QuickJS) into target processes via DLL injection, providing scripting APIs for memory manipulation, function hooking, and game automation through named pipe IPC.
@@ -0,0 +1 @@
 An Android input event recorder and replayer that captures touchscreen and key events via /dev/input and replays them with precise timing, packaged as a Magisk module for automated game input simulation.
@@ -0,0 +1 @@
 A radare2 plugin that integrates the garlic binary format parser, enabling analysis of Android DEX, APK, ELF, PE, and Mach-O files through radare2's IO and analysis framework with in-memory stream support.
@@ -0,0 +1 @@
 A Windows tool that uses a kernel driver to terminate protected processes (such as antivirus and EDR) by bypassing process protection mechanisms through direct kernel-level process object manipulation.
@@ -0,0 +1 @@
 A minimal GDB remote stub server for debugging 32-bit executables on legacy Windows (9x/XP), implementing GDB RSP protocol with breakpoints, memory reads, register queries, and thread support for Binary Ninja integration.
@@ -0,0 +1 @@
 An IDA Pro MCP server with a companion kernel driver that extends IDA's analysis capabilities with live kernel memory access, enabling AI agents to perform both static and dynamic reverse engineering through a unified protocol.
@@ -0,0 +1 @@
 A fork of angr (the binary analysis framework) with Rust-accelerated core components, providing symbolic execution, CFG recovery, data-flow analysis, and vulnerability detection with improved performance through native Rust modules.
--- a/Show More
+++ b/Show More
		`@@ -0,0 +1 @@`
							`Codex skills for generating game-ready 2D sprites and layered maps using AI image generation, with local post-processing pipelines that clean, split, validate, and export assets for Godot, Unity, or raw 2D workflows.`
		`@@ -0,0 +1 @@`
							`A Windows driver static analysis and bug hunting tool that performs IOCTL dispatch recovery, taint analysis, emulation-based handler tracing, certificate verification, YARA scanning, and PoC generation to find vulnerabilities in kernel drivers.`
		`@@ -0,0 +1 @@`
							`A polymorphic mutation engine for mimikatz that uses disassembly, CFG analysis, instruction-level morphing (register renaming, junk insertion, equivalent substitution), and data-flow obfuscation to generate unique variants that evade signature-based detection.`
		`@@ -0,0 +1 @@`
							`A Rust-based binary auditing tool that locates calls to potentially insecure functions (strcpy, sprintf, system, ioctl, etc.) in compiled binaries to identify candidate vulnerability points for manual review.`
		`@@ -0,0 +1 @@`
							`A C++/Rust/Python library that wraps Ghidra's native decompiler (SLEIGH + Pcode) for headless binary analysis, providing APIs for disassembly, decompilation, CFG construction, type system manipulation, and cross-reference queries without a JVM.`
		`@@ -0,0 +1 @@`
							`An ETW-based process monitoring system with a kernel driver that collects thread creation, image load, and memory allocation events, paired with a user-mode analysis engine to detect suspicious behaviors like injection and hollowing.`
		`@@ -0,0 +1 @@`
							`A proof-of-concept tool that detects stack spoofing in CET-enabled processes by comparing the hardware shadow stack against the user-mode call stack to identify missing or mismatched frames.`
		`@@ -0,0 +1 @@`
							`Research project analyzing EasyAntiCheat's Linux userland module, including VM-based obfuscation handler tracing, dispatch table recovery, GDB-assisted dynamic analysis, and control-flow deobfuscation of EAC's protected code.`
		`@@ -0,0 +1 @@`
							`A pipeline-driven identity sanitization framework that strips PII, hardware fingerprints, and telemetry artifacts from machines through configurable YAML-defined cleaning stages with extensible custom pipeline support.`
		`@@ -0,0 +1 @@`
							`A .NET-based binary analysis and emulation framework using Unicorn Engine that supports x86/x64/ARM Windows and Linux binaries, providing syscall emulation, PE/ELF loading, API hooking, and configurable analysis for reverse engineering.`