Windows 11 compatible NtUserXxx syscall hook inside Win32k with PoC implementation and Usermode framework in both of C and C++
-
Updated
Mar 29, 2026 - C++
#
ntuser
Here are 2 public repositories matching this topic...
UserAssist forensic analyzer — decodes Windows GUI execution evidence (NTUSER.DAT) and flags masquerade/staging anomalies. Rust: userassist-core reader + userassist-forensic analyzer/CLI.
windows rust incident-response dfir digital-forensics registry-forensics execution-evidence ntuser userassist
-
Updated
Jul 16, 2026 - Rust
Improve this page
Add a description, image, and links to the ntuser topic page so that developers can more easily learn about it.
Add this topic to your repo
To associate your repository with the ntuser topic, visit your repo's landing page and select "manage topics."