Open-source alternatives to Kernel Bridge

This repository is a collection of reference source code and implementation examples for developing drivers using the Windows Driver Kit. It provides hardware device driver samples and development templates for building kernel-mode software that enables communication between the Windows operating system and hardware devices. The library includes examples for creating universal Windows drivers, which utilize a shared set of interfaces to operate across multiple versions of the operating system. It also contains specialized implementation samples for various hardware categories, including netwo

WinFSP is a framework for implementing custom file systems on Windows. It enables the creation of user-mode file systems that appear as standard disk drives or network shares to the operating system, allowing developers to implement file system logic in user space via a proxy architecture that avoids the need for custom kernel code. A primary differentiator is its FUSE compatibility layer, which maps POSIX-based file system calls to native Windows requests. This allows existing file systems written for the FUSE API to be ported to Windows and Cygwin environments. The project covers a wide ra

KernelSU is a kernel-based root management framework for Android that provides administrative access to applications by operating directly within the operating system kernel. By integrating management logic into the kernel source, it enables system-wide permission control through syscall interception and function patching. This approach allows for the enforcement of fine-grained mandatory access control, assigning custom security domains to root processes to restrict their capabilities and prevent unauthorized actions. The project distinguishes itself through a systemless modification archite

FRRouting is an internet routing suite comprising a collection of daemons that implement standard IPv4 and IPv6 routing protocols. It provides a protocol engine for BGP, an EVPN network virtualizer, and an MPLS label manager, alongside a gRPC routing interface for programmatic configuration and data retrieval using YANG models. The suite is distinguished by its extensibility through a Lua scripting framework that executes custom scripts at internal hooks to modify routing behavior. It also features a transactional configuration model that uses separate candidate and running databases to ensur

This project is a red teaming knowledge base and offensive security playbook designed to simulate adversary behavior. It serves as a comprehensive collection of technical guides and tactics for executing red team operations. The repository provides detailed instructions for Active Directory exploitation, including Kerberos abuse and domain privilege escalation. It covers defense evasion through API unhooking and payload obfuscation, as well as Windows internals research involving the manipulation of kernel objects and system memory. The capability surface extends to network penetration testi

GodEye is a runtime instrumentation tool and observability framework for Swift mobile applications. It functions as a mobile application debugger and in-process diagnostic overlay, providing a visual interface rendered directly over active applications to monitor metrics and inspect system states without requiring changes to the original source code. The framework enables real-time analysis through a suite of debugging workflows. It captures diagnostic data using method swizzling and system-level hooking to intercept function calls and monitor internal application behavior. The tool covers s

Asterinas is a memory-safe operating system kernel designed to prevent data races and memory corruption. It functions as a Linux-ABI compatible kernel, enabling the execution of existing Linux binaries and container workloads while providing a declarative operating system distribution model. The project distinguishes itself by acting as a virtual machine container host and a confidential computing guest OS, allowing it to run within hardware-isolated Trusted Execution Environments such as Intel TDX. It implements a minimal trusted computing base by isolating unsafe low-level operations and se

The Linux Kernel Module Programming Guide is an educational resource that teaches how to write, compile, and manage loadable kernel modules for modern Linux kernels. It covers the complete lifecycle of kernel modules, from building and loading to unloading and debugging, with a focus on extending kernel functionality without recompiling the entire kernel. The guide provides comprehensive coverage of core kernel programming concepts including dynamic module loading, file-operation registration, interrupt handling, kernel-user data copying, concurrency control, and deferred task scheduling. It

parsec-vdd is a virtual display driver manager and headless server display emulator. It simulates active software-defined monitors to enable remote desktop sessions and game streaming on host systems that lack physical displays. The project provides a system tray interface for managing the monitor lifecycle, allowing users to add or remove virtual screens and capture screenshots. It enables the definition of custom widths, heights, and refresh rates for these virtual displays via system registry presets. The tool handles display property configuration and monitors device status using hardwar

ViGEmBus is a Windows kernel-mode driver and USB HID emulation framework that creates virtual gaming peripherals. It functions as a virtual gamepad driver that the operating system recognizes as physical hardware devices at the kernel level. The project enables kernel-level hardware mimicry to bypass game-specific device requirements and supports remote input redirection, allowing controller data to be sent over a network to a remote machine. The system covers a range of capabilities including USB game controller emulation and game input automation, which allows for the recording and playbac

This project is a Go library and runtime for loading and managing eBPF programs and maps. It provides a bytecode loader and kernel interface to inject instructions into kernel hooks for system-level execution and observability across both Linux and Windows operating systems. The library features a relocation engine and tooling to ensure program compatibility across different kernel versions and distributions. It supports portable deployment by embedding compiled objects for multiple CPU architectures into a single binary and provides the ability to load signed system drivers on Windows. The

embedded-notes is a collection of technical study guides and development notes focused on embedded Linux, Linux kernel internals, and C programming. It serves as a reference for embedded systems development and a preparation resource for technical interviews in the field. The project provides detailed documentation on writing device drivers, managing virtual memory, and understanding kernel internals. It also includes guides on IoT network protocols, such as MQTT and TCP/IP, and outlines the architectural details of chip architectures and hardware peripherals. The material covers a broad sur

usbipd-win is a USB device sharing tool and network device driver that binds physical USB hardware to a network protocol. It serves as a management interface for sharing and attaching USB devices via network protocols, specifically providing a utility to map shared hardware directly into Windows Subsystem for Linux instances. The project implements USB over IP networking to share locally connected devices over a network for discovery by remote client machines. It enables virtual machine USB passthrough, allowing guest operating systems to interact with physical hardware directly. The softwar

macfuse is a framework for implementing custom file systems in user space. It utilizes a macOS kernel extension to bridge the operating system kernel's virtual file system layer to a user-process daemon. This project allows the implementation of file system logic outside of the kernel to improve system stability and simplify development. It enables the mapping of remote data, network resources, or memory to a local folder so they can be accessed through standard system interfaces. The framework supports the development of cross-platform storage by providing a portable interface for consisten

System Informer is a diagnostic utility designed for the monitoring and management of Windows system components. It provides comprehensive visibility into process execution, system services, and hardware resource utilization, allowing users to track real-time performance metrics and analyze active system activity. The software distinguishes itself through deep integration with the operating system, utilizing kernel-mode driver interfacing to access low-level data and perform administrative actions. It features a plugin-based architecture that allows for the integration of external modules to

This project provides a framework and toolset for developing memory-safe kernel-mode and user-mode drivers for the Windows operating system. It enables developers to build drivers using safe programming patterns that prevent common memory errors and system crashes, while providing the necessary infrastructure to interface with low-level hardware and system APIs. The framework distinguishes itself by offering procedural macros and binding generation tools that translate complex C-style system headers into idiomatic, type-safe code. It includes a custom global allocator designed for the strict

This project is a Linux kernel designed for Windows Linux integration, providing the underlying operating system kernel required to execute binary files and applications within the Windows Subsystem for Linux. It utilizes hypervisor-based virtualization to run a full kernel within a lightweight utility virtual machine managed by a Windows host. The repository enables the customization and compilation of the kernel from source. This allows for the modification of system behavior, the addition of specific drivers, and the tailoring of hardware compatibility for virtualized environments. The sy

Sandboxie is an operating system-level virtualization tool designed to run Windows applications in isolated, secure environments. By intercepting system calls and redirecting file system and registry modifications to a separate, discardable storage area, it prevents untrusted software from making permanent changes to the host system. This containment ensures that browser history, temporary files, and potential malware remain trapped within the sandbox, protecting the integrity and privacy of the underlying host. The software distinguishes itself through granular control over the isolation env

UTM is a comprehensive virtualization suite that provides a unified interface for running guest operating systems on host hardware. It functions as a cross-platform system emulator and hypervisor, coordinating both hardware-accelerated virtualization and software-based instruction emulation to execute diverse operating systems. By leveraging native kernel-level virtualization frameworks, the software achieves near-native performance while maintaining strict security through sandboxed process isolation. The project distinguishes itself by enabling full-featured desktop operating systems to run

Hammerspoon is a programmable automation engine for macOS that enables deep system-level control through a Lua scripting environment. By bridging high-level scripts with native Objective-C APIs, it allows users to interact with the operating system's accessibility tree, intercept hardware input streams, and manage the lifecycle of running applications. The project distinguishes itself through an event-driven architecture that registers asynchronous hooks for system notifications and hardware events. This allows for real-time automation, such as remapping keyboard and mouse inputs, managing wi

Firecracker is a virtual machine monitor that leverages hardware-assisted virtualization to create and manage isolated execution environments. It functions as a lightweight runtime designed to launch virtual machines with minimal memory overhead and near-instantaneous startup times, providing the security of traditional hardware virtualization with the efficiency of containerized workloads. The project distinguishes itself through a security-focused architecture that enforces strict process boundaries using system-level barriers and restricted user privileges. It minimizes the attack surface

MemProcFS is a volatile memory analysis tool and cross-platform memory acquisition system. It functions as a memory forensic virtual file system, mapping physical memory and kernel objects into a virtual directory structure that allows users to analyze system artifacts using standard file system tools. The project distinguishes itself by providing a virtual file system for memory forensics, enabling the browsing and querying of physical memory as read-only files and folders. It also incorporates a Yara-based memory scanner to identify malware signatures and injected code within physical memor

Tracee is a cloud-native runtime security and forensics tool that uses eBPF to capture system calls and kernel events in real time. It operates as a standalone binary or a Helm-deployable agent for Kubernetes, normalizing system calls, network events, and container activities into a unified event pipeline for consistent analysis. The tool distinguishes itself through policy-driven event filtering using YAML-based rules, allowing users to target specific workloads and reduce noise during monitoring. It includes built-in threat detection signatures that flag suspicious behavioral patterns witho

OpenEDR is an endpoint detection and response platform designed to collect telemetry and monitor system activity to identify security breaches. It functions as a host-based intrusion detection system and telemetry collector, gathering detailed data on process, network, and file activity. The system includes a dockerized security stack that bundles search, logging, and visualization tools into containers for analyzing endpoint telemetry. It features a security event visualizer that maps process lineage and indexes logs to facilitate root-cause analysis of attacks. The platform provides capabi

HyperDbg is a hardware-assisted kernel-mode debugging platform that leverages virtualization to monitor and control system execution. By utilizing hypervisor-level primitives, it enables deep system analysis and instrumentation without relying on standard operating system debugging interfaces. The framework provides a comprehensive environment for inspecting both kernel and user-mode processes, allowing for granular control over execution flow and system state. The project distinguishes itself through a transparent debugging layer designed to remain invisible to the target environment. It emp

Kata Containers is an OCI container runtime that launches containers inside lightweight virtual machines to combine hardware-level isolation with container operational speed. It functions as a hardware-isolated container engine and lightweight VM hypervisor, providing a virtual machine monitor interface that abstracts multiple hypervisors to optimize for performance or specific hardware emulation. The project distinguishes itself through a confidential computing runtime that leverages hardware-backed trusted execution environments, such as Intel TDX and AMD SEV-SNP, to protect data in use. It

This project is a macOS keyboard remapping utility that intercepts and transforms hardware input events to customize key mappings, mouse behavior, and system automation. It utilizes a kernel-level input interceptor to modify or block raw hardware signals before they reach the operating system, paired with a state-aware rule engine that processes signals through conditional logic based on the active application or hardware. The system includes a human interface device emulator to inject synthesized keyboard and mouse events into macOS and a keyboard macro system for executing shell commands, l