ntuser

Here are 2 public repositories matching this topic...

rhaym-tech / Win11PtrSwap

Windows 11 compatible NtUserXxx syscall hook inside Win32k with PoC implementation and Usermode framework in both of C and C++

windows hook kernel syscalls windows-nt win32k syscall-hooking ntuser

Updated Mar 29, 2026
C++

SecurityRonin / userassist-forensic

Star

UserAssist forensic analyzer — decodes Windows GUI execution evidence (NTUSER.DAT) and flags masquerade/staging anomalies. Rust: userassist-core reader + userassist-forensic analyzer/CLI.

windows rust incident-response dfir digital-forensics registry-forensics execution-evidence ntuser userassist

Updated Aug 20, 2026
Rust

Add this topic to your repo

To associate your repository with the ntuser topic, visit your repo's landing page and select "manage topics."

Learn more