0xcf80 / ShellCodeLoader_Indirect_Syscalls
Shellcode Loader using indirect syscalls
☆14Updated last year
Alternatives and similar repositories for ShellCodeLoader_Indirect_Syscalls:
Users that are interested in ShellCodeLoader_Indirect_Syscalls are comparing it to the libraries listed below
- ☆36Updated last year
- "D3MPSEC" is a memory dumping tool designed to extract memory dump from Lsass process using various techniques, including direct system c…☆24Updated 4 months ago
- Section-based payload obfuscation technique for x64☆59Updated 5 months ago
- A POC of a new “threadless” process injection technique that works by utilizing the concept of DLL Notification Callbacks in local and re…☆21Updated last year
- Experimental PoC for unhooking API functions using in-memory patching, without VirtualProtect, for one specific EDR.☆39Updated last year
- ☆47Updated last year
- ☆28Updated 6 months ago
- SAM Dumping in C#☆40Updated 2 weeks ago
- This project is an EDRSandblast fork, adding some features and custom pieces of code.☆21Updated last year
- Basic implementation of Cobalt Strikes - User Defined Reflective Loader feature☆98Updated last year
- ☆48Updated 3 months ago
- a short C code POC to gain persistence and evade sysmon event code registry (creation, update and deletion) REG_NOTIFY_CLASS Registry Cal…☆51Updated last year
- Execute dotnet app from unmanaged process☆68Updated last month
- ☆39Updated 2 years ago
- A remote process injection using process snapshotting based on https://gitlab.com/ORCA000/snaploader , in rust. It creates a sacrificial …☆42Updated this week
- Unhook Ntdll.dll, Go & C++.☆17Updated 6 months ago
- ☆19Updated 5 months ago
- ☆28Updated 7 months ago
- Tool to bypass LSA Protection (aka Protected Process Light)☆44Updated 3 weeks ago
- Code snippets to add on top of cobalt strike sleep mask to achieve patchless hook on AMSI and ETW☆82Updated last year
- Exploiting the KsecDD Windows driver through Server Silos☆38Updated 2 months ago
- SharpExShell automates the DCOM lateral movment technique which abuses ActivateMicrosoftApp method of Excel application.☆68Updated 8 months ago
- A work in progress BOF/COFF loader in Rust☆46Updated last year
- I have documented all of the AMSI patches that I learned till now☆69Updated last year
- Socks4a proxy leveraging PIC, Websockets and static obfuscation on assembly level☆25Updated 2 years ago
- DLL proxy load example using the Windows thread pool API, I/O completion callback with named pipes, and C++/assembly☆60Updated 10 months ago
- Bypassing Amsi using LdrLoadDll☆32Updated 3 weeks ago
- ☆62Updated 11 months ago
- Threadless shellcode injection tool☆63Updated 5 months ago
- BYOVD collection☆21Updated 10 months ago