0x00Alchemist / PicoHook
Small driver that uses alternative syscalls feature (the project is still under development).
☆15Updated 6 months ago
Related projects ⓘ
Alternatives and complementary repositories for PicoHook
- ntoskrnl .data hooks for UM-KM communication☆34Updated 5 months ago
- PAGE_GUARD based hooking library☆39Updated 2 years ago
- Kernel Level NMI Callback Blocker☆32Updated 2 months ago
- POC Hook of nt!HvcallCodeVa☆49Updated last year
- ☆24Updated last month
- Experiment with PAGE_GUARD protection to hide memory from other processes☆36Updated 4 months ago
- A poc that abuses Enclave☆36Updated 2 years ago
- Windows PDB parser for kernel-mode environment.☆87Updated last year
- Patches DSE by swapping both data ptrs located in SeValidateImageHeader && SeValidateImageData☆19Updated 9 months ago
- Create stealthy, inline, EPT-like hooks using SMAP and SMEP☆32Updated 3 weeks ago
- ZeroImport is a lightweight and easy to use C++ library for Windows Kernel Drivers. It allows you to hide any import in your kernel drive…☆45Updated last year
- PoC kernel to usermode injection☆57Updated 8 months ago
- PoC over some VMP features☆16Updated 9 months ago
- Tool to dump EFI runtime drivers.☆34Updated 8 months ago
- Bypassing kernel patch protection runtime☆19Updated last year
- partially disable patchguard up to win11 21H2☆16Updated 5 months ago
- detect hypervisor with Nmi Callback☆34Updated 2 years ago
- intel vt-x type 2 hypervisor☆48Updated 4 months ago
- Another UEFI runtime bootkit☆29Updated last year
- Hijack NotifyRoutine for a kernelmode thread☆41Updated 2 years ago
- 将驱动映射到会话空间☆32Updated 2 years ago
- IDA scripts for hypervisor (Hyper-v) analysis and reverse engineering automation☆25Updated 2 years ago
- Binary DisASseMbler☆23Updated 2 years ago