3intermute / ramiel
uefi diskless persistence technique + OVMF secureboot bypass
☆61Updated last year
Alternatives and similar repositories for ramiel:
Users that are interested in ramiel are comparing it to the libraries listed below
- bypassing intel txt's tboot integrity checks via coreboot shim☆66Updated last month
- Windows kernel debugger for Linux hosts running Windows under KVM/QEMU☆79Updated 6 months ago
- Abusing exceptions for code execution.☆110Updated 2 years ago
- Using Microsoft Warbird to automatically unpack and execute encrypted shellcode in ClipSp.sys without triggering PatchGuard☆245Updated 2 years ago
- All LLVM binaries scrambled with SigBreaker and used to test against llvm-lit☆14Updated 3 weeks ago
- Report and exploit of CVE-2024-21305.☆34Updated last year
- Demystifying PatchGuard is a comprehensive analysis of Microsoft's security feature called PatchGuard, which is designed to prevent unaut…☆120Updated 2 years ago
- Implementation of an export address table protection mitigation, like Export Address Filtering (EAF)☆100Updated last year
- A journal for $6,000 Riot Vanguard bounty.☆63Updated last year
- vulnerability in zam64.sys, zam32.sys allowing ring 0 code execution. CVE-2021-31727 and CVE-2021-31728 public reference.☆92Updated 3 years ago
- ☆126Updated last month
- Converted phnt (Native API header files from the System Informer project) to IDA TIL, IDC (Hex-Rays).☆136Updated 8 months ago
- Recursive and arbitrary code execution at kernel-level without a system thread creation☆154Updated 2 years ago
- Minifilter Callback Patching Proof-of-Concept☆71Updated 2 years ago
- I/O Cache-As-Ram + AMD x86_64 cache line locking | Mirror of https://codeberg.org/3itch/icekit☆14Updated last month
- Report and exploit of CVE-2023-36427☆90Updated last year
- ☆87Updated 11 months ago
- A set of LLVM and GCC based plugins that perform code obfuscation.☆123Updated 2 months ago
- Hooking Windows' exception dispatcher to protect process's PML4☆167Updated 3 months ago
- Finding Truth in the Shadows☆92Updated 2 years ago
- The Windbg extensions to study Hyper-V on Intel and AMD processors.☆152Updated 2 months ago
- ☆71Updated 2 years ago
- ☆89Updated 2 months ago
- Using MMIO (Memory-Mapped I/O) to read TPM 2.0 public Endorsement Key.☆40Updated 11 months ago
- Code from process of reversing Sysinternals Suite for educational purposes, with videos to associate them☆48Updated last year
- Integration of Microsoft Warbird with the MSVC compiler☆103Updated last year
- An x64dbg plugin which helps make sense of long C++ symbols☆59Updated last year
- Detours implementation (x64/x86) which used only ntdll import☆90Updated 10 months ago
- Windows KASLR bypass using prefetch side-channel☆92Updated last year
- masm32 kernel programming, drivers, tutorials, examples, and tools (credits Four-F)☆123Updated last year