• Stars
    star
    462
  • Rank 91,654 (Top 2 %)
  • Language
    C++
  • License
    BSD 3-Clause "New...
  • Created over 2 years ago
  • Updated 3 months ago

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

Hex-Rays microcode plugin for automated simplification of Windows Kernel decompilation.

NtRays

NtRays is a Hex-Rays microcode plugin for automated simplification of Windows Kernel decompilation.

Features

  • Cleanup of instrumentation and scheduler hinting code.

  • Lifting of multiple missing instructions.

  • Lifting of TrapFrame accesses and interrupt/syscall returns.

  • Inference of KUSER_SHARED_DATA segments.

  • Lifting of dynamic relocations for page tables and PFN database with LA57 support.

  • RSB flush lifting in ISRs.

  • Replacement of KTHREAD/KPROCESS with ETHREAD/EPROCESS in user types, local variables and arguments.

Installation

Simply drop the NtRays64.dll into the plugins folder. Note: IDA 7.6+ is required.

License

NtRays is licensed under BSD-3-Clause License.