SamuelTulach

C# Open-Source Winforms application for uploading files to VirusTotal

Kernel-mode Windows HWID spoofer

PoC EFI runtime driver for memory r/w & kdmapper fork

Minimalistic AMD-V/SVM hypervisor with memory introspection capabilities

Single-header, minimalistic, cross-platform hook library written in pure C

PoC HWID spoofer that runs in EFI

Hide SMBIOS/disk/NIC serials from EFI bootkit

Hooking Windows' exception dispatcher to protect process's PML4

Using Windows' own bootloader as a shim to bypass Secure Boot

Simple proof of concept kernel mode driver hooking tpm.sys dispatch to randomize any public key reads

Simple EFI runtime driver that hooks GetVariable function and returns data expected by Windows to make it think that it's running with secure boot enabled (faking secure boot)

State of the art DLL injector that took 20 minutes to make

Simple proof of concept showing how you can use Discord's in-game internal module to draw on top of the game (even if the game is in fullscreen) from an external application without modifying any...

Using CVE-2023-21768 to manual map kernel mode driver

Yet another IDA Pro/Home plugin for deobfuscating stack strings

Archive R/W into any protected process by changing the value of KTHREAD->PreviousMode

Guide for patching AMI Aptio V UEFI firmware to circumvent Secure Boot checks

Cheat for my own game SecureGame which uses a bootkit to hyperjack Hyper-V in order to access VBS enclave's memory

PoC TSC offsetting in KVM

Open-source application for detecting sound direction using 7.1 audio device in games

A basic demonstration of directly overwriting paging structures for physical memory r/w and interprocess memory copy

Using CVE-2021-40449 to manual map kernel mode driver

Hide external overlay by using SetWindowDisplayAffinity

Simple IDA Pro plugin to download Unity debug symbols from their symbol server

Proof-of-concept game using VBS enclaves to protect itself from cheating

Project template for single-window GUI apps using Dear ImGui

Experiment with PAGE_GUARD protection to hide memory from other processes