3intermute / ramiel

Related projects ⓘ

Alternatives and complementary repositories for ramiel

• Azvanzed / CVE-2024-44083
  Makes IDA (most versions) to crash upon opening it.
  ☆62Updated 2 months ago
• connormcgarr / EATGuard
  Implementation of an export address table protection mitigation, like Export Address Filtering (EAF)
  ☆92Updated last year
• rbmm / NtDetours
  Detours implementation (x64/x86) which used only ntdll import
  ☆88Updated 4 months ago
• zer0condition / ZeroThreadKernel
  Recursive and arbitrary code execution at kernel-level without a system thread creation
  ☆154Updated last year
• Dump-GUY / IDA_PHNT_TYPES
  Converted phnt (Native API header files from the System Informer project) to IDA TIL, IDC (Hex-Rays).
  ☆114Updated 2 months ago
• carlos-al / user-kernel-syscall-hook
  ☆80Updated 5 months ago
• gabriellandau / ShadowStackWalk
  Finding Truth in the Shadows
  ☆84Updated last year
• zer0condition / Demystifying-PatchGuard
  Demystifying PatchGuard is a comprehensive analysis of Microsoft's security feature called PatchGuard, which is designed to prevent unaut…
  ☆106Updated last year
• Nordgaren / stealth-win
  ☆41Updated last year
• kkent030315 / Van1338
  A journal for $6,000 Riot Vanguard bounty.
  ☆57Updated last year
• D4stiny / ExceptionOrientedProgramming
  Abusing exceptions for code execution.
  ☆106Updated last year
• KiFilterFiberContext / windows-software-policy
  Research on obfuscated licensing APIs / CLIP service in the Windows kernel
  ☆85Updated 2 years ago
• realoriginal / blacklotus
  A attempt at replicating BLACKLOTUS capabilities, whilst not acting as a direct mimic.
  ☆85Updated last year
• irql / CVE-2021-31728
  vulnerability in zam64.sys, zam32.sys allowing ring 0 code execution. CVE-2021-31727 and CVE-2021-31728 public reference.
  ☆89Updated 3 years ago
• KiFilterFiberContext / warbird-obfuscator
  Integration of Microsoft Warbird with the MSVC compiler
  ☆85Updated last year
• jonaslyk / temp
  ☆65Updated last year
• ergrelet / themida-spotter-bn
  A Binary Ninja plugin to detect Themida, WinLicense and Code Virtualizer's obfuscated code locations.
  ☆73Updated 3 months ago
• namazso / dll-universal-patcher
  A universal binary patching dll.
  ☆79Updated last month
• KiFilterFiberContext / warbird-hook
  Using Microsoft Warbird to automatically unpack and execute encrypted shellcode in ClipSp.sys without triggering PatchGuard
  ☆236Updated 2 years ago
• zer0condition / ZeroHVCI
  Achieve arbitrary kernel read/writes/function calling in Hypervisor-Protected Code Integrity (HVCI) protected environments calling withou…
  ☆172Updated 2 weeks ago
• greyb1t / GreyM
  Me fockin' pe protector
  ☆44Updated last year
• Internet-2-0 / Malcore-x64dbg
  This x64dbg plugin allows you to upload your sample to Malcore and view the results.
  ☆32Updated last year
• realoriginal / angryorchard
  A kernel vulnerability used to achieve arbitrary read-write on Windows prior to July 2022
  ☆105Updated last year
• hasherezade / pe_unmapper
  Small tool to convert beteween the PE alignments (raw and virtual).
  ☆81Updated last year
• eversinc33 / unKover
  PoC Anti-Rootkit/Anti-Cheat Driver.
  ☆157Updated last month
• crvvdev / vac-bypass-kernel
  Fully working kernel-mode VAC bypass
  ☆35Updated 2 weeks ago
• m417z / x64dbg-symbol-tldr
  An x64dbg plugin which helps make sense of long C++ symbols
  ☆59Updated last year
• OALabs / uwudbg-theme
  The best theme for x64dbg!
  ☆80Updated 2 years ago
• cristeigabriel / re-sysinternals-suite
  Code from process of reversing Sysinternals Suite for educational purposes, with videos to associate them
  ☆48Updated last year
• xenoscr / manual-syscall-detect
  A tool for detecting manual/direct syscalls in x86 and x64 processes using Nirvana Hooks.
  ☆104Updated 2 years ago