Tool

NtRays

NtRays is a Hex-Rays microcode plugin that simplifies Windows kernel decompilation. It cleans scheduler hints, lifts missing instructions, TrapFrame accesses, KUSER_SHARED_DATA, dynamic page-table relocations with LA57, and SYSCALL instructions with selectable Nt signatures. It also replaces KTHREAD and KPROCESS with ETHREAD and EPROCESS. cmake takes IDA_SDK_DIR and HEXRAYS_SDK_DIR. The Windows build uses Visual Studio 2022. NtRays64.dll goes in the plugins folder. IDA 7.6 or newer is required.

Targets: Binary
Category: Native analysis tools
Relationship: Foundation tool
Sources reviewed: 2026-11-07

Stars: 682
Last commit: 2025-01-28
Language: C++
License (GitHub): BSD-3-Clause

GitHub data as of 2026-11-09

Copy as Markdown View JSON Cite

Requirements & limits

IDA 7.6 or newer, the IDA SDK, and the Hex-Rays SDK. Pass those directories as IDA_SDK_DIR and HEXRAYS_SDK_DIR.
License: BSD-3-Clause.

Cite

BibTeX

@misc{ntrays,
  title = {{NtRays}},
  howpublished = {\url{https://github.com/can1357/NtRays}},
  url = {https://github.com/can1357/NtRays},
  urldate = {2026-11-07},
  note = {Awesome REA entry: \url{https://awesomerea.org/resources/ntrays/}}
}

Plain text

NtRays. https://github.com/can1357/NtRays (accessed 2026-11-07). Awesome REA entry: https://awesomerea.org/resources/ntrays/

Useful? Star Awesome REA on GitHub2.4k

About this entry

The description was reviewed against primary sources.

Report an outdated entry Suggest a translation fix

Primary sources

README.md GitHub · can1357/NtRays · Revision 254eea6