Runnable windows examples for the FairplayLab Bible.

Full docs:

https://bible.fairplaylab.org/

• docs/ contains the GitBook source
• docs/usermode/ contains usermode detection writeups
• docs/kernel/ contains kernel mode detection writeups
• usermode/ contains runnable usermode demos
• kernel/ contains kernel driver PoCs and usermode clients
• usermode/code_injection/ shows dll injection and private executable thread signals
• usermode/external_read_write_process_memory/ shows external process memory reads and writes
• usermode/internal_read_write_memory/ shows internal memory reads, writes, patches, and usermode checks
• usermode/overlay_window/ shows overlay window detection
• usermode/process_handle/ shows process handle detection and handle hijacking
• usermode/thread_context_hijack/ shows hijacking an existing thread context
• kernel/process_handle_callbacks/ shows process and thread handle protection with ObRegisterCallbacks
• kernel/process_image_thread_monitor/ shows process, image, and thread callback telemetry
• kernel/driver_inventory/ shows loaded kernel module inventory
• kernel/runtime_attestation/ retrieves signed Secure Kernel runtime reports
• kernel/communication_surface/ shows a safe driver communication surface and dispatch ownership checks

Later categories should live next to usermode/ with the same style, for example kernel/, hypervisor/, and dma/.

Each example uses the same folder shape:

category/detection_name/
  client/
  driver/
  CMakeLists.txt
  readme.md
  bin/windows-x64/

Build everything from the repo root:

cmake -S . -B build -A x64
cmake --build build --config Release

Or build only one example from its folder:

cmake -S . -B build -A x64
cmake --build build --config Release

The checked in binaries live in bin/windows-x64. Fresh local builds live in build.