# NtRays

> NtRays is a Hex-Rays microcode plugin that simplifies Windows kernel decompilation. It cleans scheduler hints, lifts missing instructions, TrapFrame accesses, KUSER_SHARED_DATA, dynamic page-table relocations with LA57, and SYSCALL instructions with selectable Nt signatures. It also replaces KTHREAD and KPROCESS with ETHREAD and EPROCESS. cmake takes IDA_SDK_DIR and HEXRAYS_SDK_DIR. The Windows build uses Visual Studio 2022. NtRays64.dll goes in the plugins folder. IDA 7.6 or newer is required.

- Type: Tool
- Targets: Binary
- Category: Native analysis tools
- Relationship: Foundation tool
- Sources reviewed: 2026-11-07
- Added to the catalog: 2026-11-09
- Original resource: <https://github.com/can1357/NtRays>
- Primary source: <https://github.com/can1357/NtRays/blob/254eea61a82406a2a2e5fe610ae3780465b30fe4/README.md>
- Catalog page: <https://awesomerea.org/resources/ntrays/>
- Record JSON: <https://awesomerea.org/resources/ntrays/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/ntrays/index.md)

## Requirements & limits

- IDA 7.6 or newer, the IDA SDK, and the Hex-Rays SDK. Pass those directories as IDA_SDK_DIR and HEXRAYS_SDK_DIR.
- License: BSD-3-Clause.

## Primary sources

1. <https://github.com/can1357/NtRays/blob/254eea61a82406a2a2e5fe610ae3780465b30fe4/README.md>

## More in Native binaries

- [Fickling](https://awesomerea.org/resources/fickling/index.md) · Tool
- [r2ghidra](https://awesomerea.org/resources/r2ghidra/index.md) · Tool
- [Oxidizer](https://awesomerea.org/resources/oxidizer/index.md) · Tool
- [E-Decompiler](https://awesomerea.org/resources/e-decompiler/index.md) · Tool
- [Nyxstone](https://awesomerea.org/resources/nyxstone/index.md) · Tool
- [Mikage Developer Edition](https://awesomerea.org/resources/mikage-dev/index.md) · Tool

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.