SHAREM is a shellcode analysis framework, capable of emulating more than 45,000 WinAPIs and virutally all Windows syscalls. It also contains its own custom disassembler, with many innovative features, such as being able to show the deobfuscated disassembly of an encoded shellcode, or integrating emulation data to enhance the disassembly.
☆492Mar 22, 2026Updated 7 months ago
Alternatives and similar repositories for sharem
Users that are interested in sharem are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- ShellWasp is a tool to help build shellcode that utilizes Windows syscalls, while overcoming the portability problem associated with Wind…☆177Aug 5, 2026Updated 2 months ago
- ROP ROCKET is an advanced code-reuse attack framework, with extensive ROP chain generation capabilities, including for novel Windows Sysc…☆187Dec 5, 2025Updated 10 months ago
- A modern 32/64-bit position independent implant template☆1,375Jun 1, 2026Updated 5 months ago
- PoC Implementation of a fully dynamic call stack spoofer☆1,015Jul 20, 2024Updated 2 years ago
- Cobalt Strike UDRL for memory scanner evasion.☆1,033Jun 4, 2024Updated 2 years ago
- End-to-end encrypted email - Proton Mail • AdSpecial offer: 40% Off Yearly / 80% Off First Month. All Proton services are open source and independently audited for security.
- Windows kernel and user mode emulation.☆2,099Updated this week
- Moneta is a live usermode memory analysis tool for Windows with the capability to detect malware IOCs☆859Oct 23, 2026Updated last week
- A POC for the new injection technique, abusing windows fork API to evade EDRs. https://www.blackhat.com/eu-22/briefings/schedule/index.ht…☆678Dec 23, 2022Updated 3 years ago
- A memory-based evasion technique which makes shellcode invisible from process start to end.☆1,202Oct 16, 2023Updated 3 years ago
- HWSyscalls is a new method to execute indirect syscalls using HWBP, HalosGate and a synthetic trampoline on kernel32 with HWBP.☆734Jul 19, 2023Updated 3 years ago
- Performing Indirect Clean Syscalls☆632May 2, 2026Updated 6 months ago
- Metamorphic cross-compilation of C++ & C-code to PIC, BOF & EXE.☆652Feb 2, 2026Updated 9 months ago
- SysWhispers on Steroids - AV/EDR evasion via direct system calls.☆1,675Jul 31, 2024Updated 2 years ago
- Shoggoth: Asmjit Based Polymorphic Encryptor☆810Apr 4, 2026Updated 6 months ago
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- An advanced in-memory evasion technique fluctuating shellcode's memory protection between RW/NoAccess & RX and then encrypting/decrypting…☆1,136Jun 17, 2022Updated 4 years ago
- x86 malware emulator☆319Updated this week
- Walks the CFG bitmap to find previously executable but currently hidden shellcode regions☆141May 17, 2023Updated 3 years ago
- Generating legitimate call stack frame along with indirect syscalls by abusing Vectored Exception Handling (VEH) to bypass User-Land EDR …☆311Jul 31, 2024Updated 2 years ago
- A PoC implementation for an evasion technique to terminate the current thread and restore it before resuming execution, while implementin…☆542Aug 1, 2022Updated 4 years ago
- Hellsgate + Halosgate/Tartarosgate. Ensures that all systemcalls go through ntdll.dll☆521Feb 3, 2022Updated 4 years ago
- PoC for a sleep obfuscation technique leveraging waitable timers to evade memory scanners.☆629Sep 26, 2023Updated 3 years ago
- Interceptor is a kernel driver focused on tampering with EDR/AV solutions in kernel space☆135Jan 2, 2023Updated 3 years ago
- A Pin Tool for tracing API calls etc☆1,713Jun 2, 2026Updated 5 months ago
- Managed hosting for WordPress and PHP on Cloudways • AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- Dynamically convert an unmanaged EXE or DLL file to PIC shellcode by prepending a shellcode stub.☆326Apr 12, 2024Updated 2 years ago
- Windows rootkit for Intel x64 with 25+ features, demonstrating rootkit techniques compatible with all Windows 10 and Windows 11 versions.☆2,545Sep 26, 2026Updated last month
- Indirect Dynamic Syscall, SSN + Syscall address sorting via Modified TartarusGate approach + Remote Process Injection via APC Early Bird …☆813Jan 26, 2026Updated 9 months ago
- Shellcode Loader with Indirect Dynamic syscall Implementation , shellcode in MAC format, API resolving from PEB, Syscall calll and syscal…☆322Aug 2, 2023Updated 3 years ago
- A proof of concept demonstrating the DLL-load proxying using undocumented Syscalls.☆411Jan 11, 2026Updated 9 months ago
- Alternative Shellcode Execution Via Callbacks☆1,739Nov 11, 2022Updated 3 years ago
- ☆117Aug 7, 2022Updated 4 years ago
- EDR Lab for Experimentation Purposes☆1,579Jun 10, 2026Updated 4 months ago
- A proof-of-concept Cobalt Strike Reflective Loader which aims to recreate, integrate, and enhance Cobalt Strike's evasion features!☆1,439Nov 22, 2023Updated 2 years ago
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- Sysmon-Like research tool for ETW☆397Nov 15, 2022Updated 3 years ago
- Converts PE into a shellcode☆2,801Aug 30, 2025Updated last year
- An EDR bypass that prevents EDRs from hooking or loading DLLs into our process by hijacking the AppVerifier layer☆558Feb 13, 2024Updated 2 years ago
- Combining Sealighter with unpatched exploits to run the Threat-Intelligence ETW Provider☆213Dec 6, 2022Updated 3 years ago
- Evasive shellcode loader for bypassing event-based injection detection (PoC)☆834Aug 23, 2021Updated 5 years ago
- "Service-less" driver loading☆192Nov 28, 2024Updated last year
- A set of fully-undetectable process injection techniques abusing Windows Thread Pools☆1,287Dec 11, 2023Updated 2 years ago