nmulasmajic

'''
	Module Name: 
		enum_win_callbacks.py
	
	Abstract:
		Iterates over the nt!PspCreateProcessNotifyRoutine,
		nt!PspCreateThreadNotifyRoutine, and nt!PspLoadImageNotifyRoutine 
		callback arrays.
		
	Requirements:

nmulasmajic

/*
*	Module Name:
*		antidebug_long_int3.cpp
*
*	Abstract:
*		Attempts to detect the presence of a debugger
*		by issuing a multi-byte int 3 and inspecting 
*		page PTE mappings.
*
*	Author:

nmulasmajic

/*
*	Module Name:
*		int3.cpp
*
*	Abstract:
*		Examines the difference in operation between a 
*		multi-byte int 3 (0xCD 0x03) and a single-byte 
*		int 3 (0xCC).
*
*	Author:

nmulasmajic

/*
*	Module Name:
*		ReadProcessMemory.cpp
*
*	Abstract:
*		Reads a blob of memory from the specified process.
*
*	Author:
*		Nemanja (Nemi) Mulasmajic <[email protected]>
*			http://triplefault.io

nmulasmajic

/*
*	Module Name: 
*		WorkingSetWatch.cpp
*
*	Abstract:
*		Tracks page faults that occur within the process.
*		
*		NOTE: This is not compatible with Wow64 and must be run as a 64-bit
*		program on x64 and a 32-bit program on x86.
*

nmulasmajic

'''
	Module Name: 
		find_nt_imagebase_x64.py
	
	Abstract:
		Discovers the base address of ntoskrnl when IDA's GDB stub is 
		loaded by leveraging the IDT.
	
		NOTE: This is only compatible for 64-bit editions of Windows.