3gstudent / HiddenNtRegistry
Use NT Native Registry API to create a registry that normal user can not query.
☆57Updated 7 years ago
Alternatives and similar repositories for HiddenNtRegistry:
Users that are interested in HiddenNtRegistry are comparing it to the libraries listed below
- An example of how x64 kernel shellcode can dynamically find and use APIs☆104Updated 4 years ago
- PoC for detecting and dumping code injection (built and extended on UnRunPE)☆56Updated 6 years ago
- PoC designed to evade userland-hooking anti-virus.☆88Updated 5 years ago
- Protects deletion of files with a specified extension using a kernel-mode driver.☆75Updated 6 years ago
- APC DLL Injector with NtQueueApcThread and wake up thread support☆42Updated 7 years ago
- Process reimaging proof of concept code☆95Updated 5 years ago
- Weaponizing Gigabyte driver for priv escalation and bypass PPL☆68Updated 5 years ago
- Shellcode to load an appended Dll☆88Updated 4 years ago
- The Minimalistic x86/x64 API Hooking Library for Windows☆32Updated 6 years ago
- Gozi-MBR-rootkit Bootkit Modified☆68Updated 8 years ago
- Analyze and attack windows applications using dll hijacking vulnerabilities☆56Updated 5 years ago
- PoC for detecting and dumping process hollowing code injection☆51Updated 6 years ago
- C++☆80Updated 8 years ago
- ☆35Updated 5 years ago
- Simple 32/64-bit PEs loader.☆136Updated 6 years ago
- Bypass UAC by abusing the Security Center CPL and hijacking a shell protocol handler☆28Updated 3 years ago
- ☆49Updated 4 years ago
- exploit termdd.sys(support kb4499175)☆58Updated 5 years ago
- Inject unsigned DLL into Protected Process Light (PPL)☆18Updated 2 months ago
- Process Doppelgänging☆155Updated 7 years ago
- Dll Convert to Shellcode.☆40Updated 2 years ago
- GUI Application in C# to run and disassemble shellcode☆35Updated 7 years ago
- A modified RunPE (process hollowing) technique avoiding the usage of SetThreadContext by appending a TLS section which calls the original…☆93Updated 5 years ago
- No inline asm,support x86/x64☆64Updated 3 years ago
- Retrieve pointers to undocumented kernel functions and offsets to members within undocumented structures to use in your driver by using t…☆53Updated 5 years ago
- A simple rootkit to hide a process☆46Updated 11 years ago
- a program to detect reflective dll injection on a live machine☆75Updated 9 years ago
- An Attempt to Bypass Memory Scanners By Misusing the ntdll.dll "RT" Section.☆95Updated 9 years ago
- Bare template for a Kernel Mode Driver☆51Updated 4 years ago
- ☆26Updated 7 years ago