Hex-Rays microcode plugin for automated simplification of Windows Kernel decompilation.

Related tags

Miscellaneous windows-kernel hex-rays-decompiler hex-rays ntoskrnl
Overview

NtRays

NtRays is a Hex-Rays microcode plugin for automated simplification of Windows Kernel decompilation.

Features

  • Cleanup of instrumentation and scheduler hinting code.

  • Lifting of multiple missing instructions.

  • Inference of KUSER_SHARED_DATA segments.

  • Lifting of dynamic relocations for page tables and PFN database with LA57 support.

  • RSB flush lifting in ISRs.

Planned Features

  • ETHREAD/EPROCESS where KTHREAD/KPROCESS is used.

Installation

Simply drop the NtRays64.dll into the plugins folder. Note: IDA 7.4+ is required.

License

NtRays is licensed under BSD-3-Clause License.

You might also like...
A decompilation of the Nintendo Switch version of Captain Toad: Treasure Tracker [v1.3.0].

cttt-decomp A decompilation of the Nintendo Switch version of Captain Toad: Treasure Tracker [v1.3.0]. Build Instructions Obtain a clean copy of a mai

shibbs 14 Aug 17, 2022
Powerful automated tool for reverse engineering Unity IL2CPP binaries
Powerful automated tool for reverse engineering Unity IL2CPP binaries

Powerful automated tool for reverse engineering Unity IL2CPP binaries

Katy 2.1k Jan 7, 2023
Proof-of-concept implementation for the paper "Osiris: Automated Discovery of Microarchitectural Side Channels" (USENIX Security'21)

Osiris This repository contains the implementation of the Osiris framework discussed in the research paper "Osiris: Automated Discovery of Microarchit

CISPA 41 Nov 11, 2022
Automated hydroponics with Home Assistant & ESP8266 controllers
Automated hydroponics with Home Assistant & ESP8266 controllers

ESPonics Automated hydroponics with ESP8266 microcontrollers & Home Assistant I absolutely want to credit Reddit user u/ghoofman for both the inspirat

jjensn 16 Aug 27, 2022
The Project name is "ATM - Automated Teller Machine" and It is for beginners level Project.

ATM - Automated Teller Machine The Project name is "ATM - Automated Teller Machine" and It is for beginners level Project. What is ATM? An automated t

Sorav Kumar Sharma 1 Nov 7, 2021
The Project name is "ATM - Automated Teller Machine" and It is for beginners level Project.

ATM - Automated Teller Machine The Project name is "ATM - Automated Teller Machine" and It is for beginners level Project. What is ATM? An automated t

Sorav Kumar Sharma 1 Nov 8, 2021
The Project name is "ATM - Automated Teller Machine" and It is for beginners level Project.

ATM - Automated Teller Machine The Project name is "ATM - Automated Teller Machine" and It is for beginners level Project. What is ATM? An automated t

Sorav Kumar Sharma 0 Dec 26, 2021
Automated builds/mirrors of various PS3SDKs for Linux systems.

Working PS3SDK Binaries NOTICE: This repo is now deprecated. SDK builds have moved here, and SDK mirrors have moved here. Prepares and releases workin

null 3 Jan 29, 2022
PET: Optimizing Tensor Programs with Partially Equivalent Transformations and Automated Corrections
PET: Optimizing Tensor Programs with Partially Equivalent Transformations and Automated Corrections

PET: Optimizing Tensor Programs with Partially Equivalent Transformations and Automated Corrections PET is the first DNN framework that optimizes tens

PACMAN Group, Tsinghua University 88 Dec 29, 2022
Comments
  • Suggestion: replacable literals

    Suggestion: replacable literals

    Since this is domain specific to NT Kernels, you could make it so that literal values (e.g. 0x80000000) are a drop down form menu containing various defines or enumeration values that match it. I don't know if it's possible with the IDA plugin API but it could be helpful.

    opened by GravisZro 0
Releases(v1.67)
Owner
Can Bölük
Security researcher and reverse engineer; mostly interested in Windows kernel development and low-level programming.
Can Bölük
GitHub
Header only wrapper around Hex-Rays API in C++20.

HexSuite HexSuite is a header only wrapper around Hex-Rays API in C++20 designed to simplify the use of Hex-Rays and IDA APIs by modern C++ features.

Can Bölük 127 Dec 6, 2022
Interactive-hex-meshing - Source code for "Interactive All-Hex Meshing via Cuboid Decomposition [SIGGRAPH Asia 2021]".

Interactive All-Hex Meshing via Cuboid Decomposition Video demonstration This repository contains an interactive software to the PolyCube-based hex-me

Lingxiao Li 131 Dec 5, 2022
A small single-file library for sprite outline extraction and simplification for C/C++

Sproutline A small single-file library for sprite outline extraction and simplification for C/C++. Input: Sprite with an alpha channel. Output: All th

ands 78 Dec 12, 2022
A decompilation of Banjo Kazooie. (MIRROR of https://gitlab.com/banjo.decomp/banjo-kazooie)

banjo Building Grab tools git submodule update --init --recursive Drop in US v1.0 as baserom.us.v10.z64 (sha1sum: 1fe1632098865f639e22c11b9a81ee8f29c7

Nintendo 64 Decompilation Projects 186 Jan 3, 2023
PaRappa the Rapper Decompilation

PaRappaSource PaRappa the Rapper Decompilation Compiling The instructions for this should largely be the same as PSXFunkin without the iso makes. You

null 15 Dec 2, 2022
An in-progress matching decompilation of Final Fantasy VII For the PSX.

FFVII An in-progress decompilation of the original US release of Final Fantasy VII on the PSX. Building (Linux) Install build dependencies The build p

null 17 Dec 14, 2022
An in-progress decompilation of the 1.1 US release of Silent Hill on the Playstation 1.

Silent Hill Decompilation Project An in-progress decompilation of the 1.1 US release of Silent Hill on the Playstation 1. Building (Linux) Install bui

Nicolas 35 Dec 25, 2022
Ezfrags - Decompilation of the CS:GO cheat ezfrags

Ezfrags Ezfrags was the first cheat of a lot of people, and probably their last. This cheat is so popular that it became a meme in the CS:GO community

null 14 Jul 7, 2022
A Super Mario 64 decompilation, brought to you by a bunch of clever folks.

Super Mario 64 This repo contains a full decompilation of Super Mario 64 (J), (U), (E), and (SH). Naming and documentation of the source code and data

Nintendo 64 Decompilation Projects 6.5k Dec 28, 2022
Decompilation of the Berry Fix Program included in Pokémon Emerald and FireRed/LeafGreen

Berry Fix This is a decompilation of the "Berry Program" multiboot image which comes compressed within Pokémon FireRed, LeafGreen, and Emerald. It is

null 8 Nov 13, 2022