Open-source alternatives to Rdpwrap

TacticalRMM is a remote monitoring and management platform designed for overseeing endpoints and automating IT administration. It functions as an endpoint management tool and IT automation framework, providing a centralized dashboard for executing scripts, monitoring system health, and managing remote devices across multiple tenants. The platform distinguishes itself through a comprehensive remote administration suite that includes real-time shell access, remote file management, and registry editing. It integrates with third-party remote desktop software and provides a hierarchical policy inh

FreeRDP is a full software implementation of the Remote Desktop Protocol, providing both client and server capabilities for remote session management. It functions as an RDP client library and a standalone remote desktop client, enabling remote connectivity and interoperability across different operating systems. The project includes a dedicated network device redirector and an RDP gateway client to handle authentication and proxy routing. It allows developers to integrate remote desktop functionality into third-party software applications via its client library. The software covers a wide r

WinSW is an executable service wrapper that transforms standard executables into background Windows services. It provides a mechanism to register arbitrary files as system services managed by the Windows operating system, ensuring applications can start automatically on boot and restart following a crash. The project includes a command-line interface for registering, starting, stopping, and monitoring the status of these processes. It handles the translation of Windows Service Control Manager signals into process termination requests for the wrapped executable. The system supports XML-based

Sylar is a high-performance C++ asynchronous server framework and event-driven network library. It functions as a coroutine scheduler and HTTP server implementation designed to build network services using non-blocking I/O. The project distinguishes itself through a system call interceptor that hooks blocking socket and sleep APIs, transforming synchronous operations into non-blocking asynchronous events. It employs a user-space threading system to distribute lightweight tasks across a worker thread pool to maximize CPU utilization. The framework covers a broad range of networking and system

This project provides configuration data structures containing build-specific memory offsets and patch codes required to activate remote desktop services. It serves as a registry of parameters and patch sets used to bypass remote desktop restrictions across various operating system builds. The repository specifically focuses on updating configuration files for the RDP Wrapper library. This ensures compatibility with new operating system builds, enabling remote desktop connectivity on editions that do not natively support the feature. The project covers system-level configuration for remote d

libco is a C++ coroutine library and user-space task orchestrator designed for cooperative multitasking and high-concurrency execution. It functions as a high-concurrency network framework and a synchronous-to-asynchronous wrapper that allows blocking system calls and socket functions to run asynchronously without modifying existing business logic. The project utilizes a specialized stack-copying context switching model to support millions of simultaneous TCP connections on a single machine. It includes a high-performance time wheel scheduler for managing asynchronous background jobs and dela

REFramework is a runtime modding framework for games built on the RE Engine, providing a C# plugin system with typed proxy code generation, a Lua scripting interface, an ImGui-based UI system, a runtime debugging toolkit, and a VR integration layer. At its core, it intercepts and modifies internal game engine functions and state at runtime through hooking and scripting APIs, enabling deep inspection and manipulation of live game objects. The framework distinguishes itself through typed proxy code generation that auto-creates C# interfaces from the game's type database, giving compile-time saf

Piko is a collection of specialized Android utilities designed for binary patching, user interface customization, media downloading, and application debugging. It functions as an APK modification framework that alters application metadata and binary resources to modify internal logic and bypass version locks. The project differentiates itself through deep application modification capabilities, including bytecode-level instruction patching, DEX file manipulation, and a dynamic hooking engine. It enables the overriding of resource files and the injection of permissions via the application manif

Xposed is a native Android runtime hooking framework and instrumentation tool. It provides a modified version of the Android app process binary to intercept and modify the behavior of system and application processes at the binary level. The framework enables Android operating system customization by altering internal function calls and runtime execution flow. It achieves this through native process instrumentation, allowing for the modification of functionality without altering original application files. The tool covers several low-level capabilities, including native library injection and

This project is a red teaming knowledge base and offensive security playbook designed to simulate adversary behavior. It serves as a comprehensive collection of technical guides and tactics for executing red team operations. The repository provides detailed instructions for Active Directory exploitation, including Kerberos abuse and domain privilege escalation. It covers defense evasion through API unhooking and payload obfuscation, as well as Windows internals research involving the manipulation of kernel objects and system memory. The capability surface extends to network penetration testi

Aspects is an aspect-oriented programming library and method hooking framework designed for intercepting and modifying JavaScript function behavior without altering the original source code. It serves as a runtime logic injector that allows for the addition and removal of executable code wrappers from active functions. The library enables the injection of custom logic before or after methods to change application behavior at runtime. It further provides the ability to intercept method calls to capture or override return values before they reach the caller. The framework manages these interce

Apache Guacamole is a clientless remote desktop gateway that translates RDP, VNC, and SSH protocols into browser-based sessions. It acts as a remote desktop protocol proxy, allowing platform-independent access to remote machines without requiring specialized client software or plugins. The system functions as an enterprise remote access gateway, integrating with LDAP and Active Directory to manage permissions via corporate credentials. It includes security mechanisms such as multi-factor authentication, connection access restrictions, and the ability to retrieve sensitive credentials from ext

Box64 is a cross-architecture runtime and user-mode emulation layer that allows Linux and Windows software to run on non-native hardware. It functions as an x86-64 instruction emulator and binary translator, executing 64-bit binaries on different CPU architectures by translating machine code into native instructions. The project utilizes dynamic recompilation to accelerate execution and maps guest system calls to native host libraries to increase speed and hardware compatibility. It can simulate a 32-bit execution environment to support legacy software and integrates with the operating system

Fastsocket is a high-performance Linux socket implementation designed for linear scalability on multicore systems. It functions as a TCP throughput optimizer and a multicore packet steering engine that reduces system call overhead and lock contention to increase total network processing capacity. The project distinguishes itself through a network system call interceptor that uses a shared library to redirect standard socket calls to optimized interfaces without requiring changes to application binaries. It employs active connection steering by encoding CPU core IDs into source ports and utili

Lilu is a kernel patching engine and runtime code injection framework designed to modify kernel drivers and libraries in memory. It functions as an operating system customization framework that intercepts function calls and redirects execution flow within the kernel to resolve hardware compatibility issues and adjust system stability. The project employs a modular platform that allows for the injection of code and the modification of system libraries during the boot process without altering files on disk. It utilizes a plugin-based extension architecture and a standardized API interface to lo

vgpu_unlock is a set of software tools and driver modifications designed to unlock enterprise-grade virtualization features on consumer graphics hardware. It functions as a vGPU unlock tool and hardware device ID spoofer that allows a single graphics card to be shared across multiple virtual machines. The project achieves this by employing driver-level hooking, dynamic memory patching, and kernel-level device spoofing. These techniques intercept hardware identification queries and modify the operational state of the GPU driver at runtime to bypass manufacturer-imposed software restrictions.

Dobby is a dynamic function hooking framework and binary instrumentation tool designed to intercept and redirect function calls in compiled binaries. It serves as a cross-platform and cross-architecture library that provides a unified interface for modifying program execution flow across different operating systems and CPU architectures. The library enables low-level binary instrumentation and runtime application instrumentation by injecting custom handlers into live processes. It is used for software reverse engineering to observe real-time data flow and logic by hooking internal functions.

CloverBootloader is a UEFI-compliant boot loader designed to initialize hardware and launch multiple operating systems across various platforms. Its primary purpose is to enable the booting of operating systems on unsupported hardware through system identity spoofing and hardware emulation. The project specializes in hardware compatibility patching by modifying ACPI tables, faking hardware IDs, and patching binary kernels or extensions in memory during the boot process. It provides capabilities to inject kernel extensions and spoof system parameters, such as product names and serial numbers,

Maybe is a command execution simulator and filesystem operation auditor. It provides a dry-run environment that records intended file changes without performing actual write operations to the disk and acts as a security layer to block unauthorized modifications. The tool intercepts system calls to preview and approve filesystem modifications before they are committed. It utilizes a user-approval execution loop that pauses program execution until a user consents to pending system operations. The system covers command execution previews, filesystem operation auditing, and system call filtering

This project is a Node.js binary distribution repository and Linux package repository. It provides a hosted set of pre-compiled JavaScript runtime binaries for various Linux distributions to simplify installation and version management through native package managers. The project includes a Node.js observability toolset and security policy manager. These components enable the gathering of runtime telemetry to monitor application health and performance via diagnostic dashboards, while providing a resource restriction layer that intercepts system calls to prevent unauthorized modules from acces

LXD is a unified platform for managing both system containers and virtual machines through a single REST API and command-line interface. It provides a programmatic HTTP interface for controlling the full lifecycle of instances, enabling automation and integration with external tools. The system runs unprivileged containers with per-instance UID/GID mappings, seccomp filters, and AppArmor profiles for kernel-level isolation, while supporting multiple storage backends including directory, Btrfs, LVM, ZFS, Ceph, LINSTOR, and TrueNAS through a unified driver interface. The platform distinguishes

This project is an OS-level process sandbox and cross-platform security wrapper for Linux and macOS. It is designed to isolate arbitrary processes from the host machine by restricting filesystem and network access without the use of full containerization. The system functions as a system-call interceptor and access controller, blocking unauthorized operating system calls based on predefined security policies. It employs allowlists and denylists to manage resource requests and monitors for security violations in real time. Capability areas include filesystem access management using glob-patte

Windhawk is a Windows OS modding framework and user-mode code injector designed to customize the behavior of Windows applications and system components. It functions as a process customization tool and API hooking engine that allows for the insertion of custom logic into running programs. The framework enables software behavior modification and user interface tweaking without requiring access to the original source code. This is achieved by intercepting function calls and altering how software interacts with the operating system to implement patches or feature enhancements. The system covers

OS.js is a browser-based desktop environment built entirely with JavaScript that runs a full graphical interface with windows, file management, and applications inside any modern web browser without requiring local software installation. It provides a web desktop platform that manages application windows as DOM elements with z-ordering, resizing, and event routing, while offering an abstracted virtual filesystem layer that unifies access across multiple storage backends through a common read/write interface. The platform connects to remote servers and desktops using SSH, VNC, or Xpra protocol

This project is a peer-to-peer networking tool and communication client designed for exchanging messages and sharing screen control between computers without a central server. It functions as a decentralized system for exchanging data and control signals directly between nodes. The application uses WebRTC for peer-to-peer messaging and remote desktop administration. It incorporates STUN-based NAT traversal and rendezvous servers to establish direct connections between peers hidden behind restrictive firewalls or routers. The software provides capabilities for remote desktop control, includin

pywin32 is a collection of Python extensions that serve as a wrapper for the native Windows API, enabling the invocation of operating system functions to manage low-level system resources and hardware. It provides a core library for interacting with Component Object Model objects to automate native desktop applications, a framework for constructing native Windows GUI applications, and an interface for registering and running Python scripts as background system services. The project distinguishes itself by providing deep integration with the Windows environment, including the ability to bind P

r0capture is a tool for intercepting network traffic from Android applications. It serves as a traffic interceptor, packet sniffer, and client certificate exporter used to analyze application-layer communication on Android devices. The project provides mechanisms to bypass SSL pinning and certificate validation, allowing the decryption of encrypted traffic without modifying device trust stores. It also enables the extraction of client-side certificates from application memory for saving to local device storage. Captured network data is serialized into PCAP files to support offline protocol a