Alternatives and similar repositories for WinKit:

Users that are interested in WinKit are comparing it to the libraries listed below

• AzAgarampur / PsForge
  Process Hollowing demonstration & explanation
  ☆35Updated 4 years ago
• knight0x07 / BumbleCrypt
  A Bumblebee-inspired Crypter
  ☆80Updated 2 years ago
• 11philip22 / CodeInjection
  Collection of shellcode injection and execution techniques
  ☆16Updated 3 years ago
• RobinFassinaMoschiniForks / TransitionalPeriod
  Former Multi - Ring to Kernel To UserMode Transitional Shellcode For Remote Kernel Exploits
  ☆28Updated 2 years ago
• PaulNorman01 / Dynamizer
  Reduce Dynamic Analysis Detection Rates With Built-In Unhooker, Anti Analysis Techniques, And String Obfuscator Modules.
  ☆19Updated 2 years ago
• AlSch092 / HideStaticReferences
  Research into removing strings & API call references at compile-time (Anti-Analysis)
  ☆25Updated 11 months ago
• APT64 / KernelAVKiller
  Antivirus killer using ring-0 kernel driver. Antivirus processes will automatically close while the killer is running.
  ☆6Updated 2 years ago
• pwn1sher / RTImplant
  Just another casual shellcode native loader
  ☆24Updated 3 years ago
• SaadAhla / BlockNonMSModules
  Set the process mitigation policy for loading only Microsoft Modules , and block any userland 3rd party modules
  ☆41Updated 2 years ago
• OtterHacker / CoffLoader
  ☆54Updated 2 years ago
• susMdT / effective-waffle
  yet another sleep encryption thing. also used the default github repo name for this one.
  ☆69Updated last year
• LethalSnake1337 / PE-Loader-exercise
  A simple PE loader.
  ☆26Updated 2 years ago
• C5Hackr / c_syscalls
  https://github.com/janoglezcampos/c_syscalls with the ASM rewritten by myself for Visual Studio's Compiler.
  ☆31Updated 10 months ago
• klezVirus / LoGiC.NET
  A more advanced free and open .NET obfuscator using dnlib.
  ☆10Updated 2 years ago
• paranoidninja / DotNetTracer
  C code to enable ETW tracing for Dotnet Assemblies
  ☆31Updated 2 years ago
• NUL0x4C / GP
  using the gpu to hide your payload
  ☆57Updated 2 years ago
• GetRektBoy724 / SyscallShuffler
  Your NTDLL vaccine from modern direct syscall methods.
  ☆35Updated 3 years ago
• loneicewolf / smbdoor
  improving zerosums smbdoor - a silent remote backdoor which abuses undoc. APIs in srvnet.sys
  ☆50Updated 2 years ago
• PorLaCola25 / PPID-Spoofing
  POC of PPID spoofing using NtCreateUserProcess with syscalls to create a suspended process and performing process injection by overwritti…
  ☆40Updated 3 years ago
• oXis / DoublePulsarPayload
  C++ implementation of DOUBLEPULSAR usermode shellcode. Yet another Reflective DLL loader.
  ☆30Updated 3 years ago
• BomboBombone / Rattuso
  A very weird RAT
  ☆19Updated 2 years ago
• PorLaCola25 / NtCreateUserProcess
  ☆12Updated 4 years ago
• aaaddress1 / masqueradeCmdline
  A PoC to demo modifying cmdline of the child process dynamically. It might be useful against process log tracing, AV or EDR.
  ☆39Updated 4 years ago
• AzAgarampur / byeintegrity5-uac
  Bypass UAC at any level by abusing the Task Scheduler and environment variables
  ☆31Updated 3 years ago
• Idov31 / UdpInspector
  Listing UDP connections with remote address without sniffing.
  ☆29Updated last year
• keowu / InstrumentationCallbackToolKit
  A fast method to intercept syscalls from any user-mode process using InstrumentationCallback and detect any process using Instrumentation…
  ☆26Updated last year
• rad9800 / BloatedHammer
  API Hammering with C++20
  ☆46Updated 2 years ago
• Narumiii / phantommap
  Phantom DLL Hollowing method implemented in modmap
  ☆17Updated 3 years ago
• AlionGreen / apc-injection
  Process Injection: APC Injection
  ☆31Updated 4 years ago
• qwqdanchun / RainbowSheep
  Change hash for a signed pe
  ☆16Updated last year