2 Repos
Techniques for interrogating the internal state and activity of an operating system kernel and object manager.
Distinct from Window Query Filters: The candidates are all related to UI window management, whereas this feature is about low-level OS internals and WMI queries.
Explore 2 awesome GitHub repositories matching operating systems & systems programming · Operating System State Analysis. Refine with filters or upvote what's useful.
HyperDbg is a hardware-assisted kernel-mode debugging platform that leverages virtualization to monitor and control system execution. By utilizing hypervisor-level primitives, it enables deep system analysis and instrumentation without relying on standard operating system debugging interfaces. The framework provides a comprehensive environment for inspecting both kernel and user-mode processes, allowing for granular control over execution flow and system state. The project distinguishes itself through a transparent debugging layer designed to remain invisible to the target environment. It emp
Displays stack backtraces, loaded modules, and system status to provide context on the current execution environment.
Velociraptor is a digital forensics and incident response platform, endpoint detection and response system, and visibility tool. It provides a query engine and remote forensic collector used to hunt for indicators of compromise and perform triage across a fleet of hosts. The system is distinguished by its specialized query language for interrogating host state and parsing binary files. It features a notebook environment that combines markdown documentation with executable query cells to standardize investigative workflows and enable collaborative reporting. The platform covers a wide range o
Velociraptor queries the Windows Object Manager and execute WMI queries to monitor OS activity.