SHAREM is a shellcode analysis framework, capable of emulating more than 45,000 WinAPIs and virutally all Windows syscalls. It also contains its own custom disassembler, with many innovative features, such as being able to show the deobfuscated disassembly of an encoded shellcode, or integrating emulation data to enhance the disassembly.
☆479Mar 22, 2026Updated this week
Alternatives and similar repositories for sharem
Users that are interested in sharem are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- ShellWasp is a tool to help build shellcode that utilizes Windows syscalls, while overcoming the portability problem associated with Wind…☆173Mar 16, 2026Updated last week
- Dont Call Me Back - Dynamic kernel callback resolver. Scan kernel callbacks in your system in a matter of seconds!☆250Jul 9, 2024Updated last year
- Helper script for Windows kernel debugging with IDA Pro on native Bochs debugger (including PDB symbols)☆62Aug 11, 2023Updated 2 years ago
- A POC for the new injection technique, abusing windows fork API to evade EDRs. https://www.blackhat.com/eu-22/briefings/schedule/index.ht…☆674Dec 23, 2022Updated 3 years ago
- Cobalt Strike UDRL for memory scanner evasion.☆1,009Jun 4, 2024Updated last year
- GPU virtual machines on DigitalOcean Gradient AI • AdGet to production fast with high-performance AMD and NVIDIA GPUs you can spin up in seconds. The definition of operational simplicity.
- Moneta is a live usermode memory analysis tool for Windows with the capability to detect malware IOCs☆814Mar 16, 2024Updated 2 years ago
- Hellsgate + Halosgate/Tartarosgate. Ensures that all systemcalls go through ntdll.dll☆500Feb 3, 2022Updated 4 years ago
- A PoC implementation for an evasion technique to terminate the current thread and restore it before resuming execution, while implementin…☆534Aug 1, 2022Updated 3 years ago
- A modern 32/64-bit position independent implant template☆1,307Mar 21, 2025Updated last year
- Interceptor is a kernel driver focused on tampering with EDR/AV solutions in kernel space☆136Jan 2, 2023Updated 3 years ago
- PoC Implementation of a fully dynamic call stack spoofer☆928Jul 20, 2024Updated last year
- Converts PE into a shellcode☆2,751Aug 30, 2025Updated 6 months ago
- Performing Indirect Clean Syscalls☆607Apr 19, 2023Updated 2 years ago
- A tool to kill antimalware protected processes☆1,506Jun 19, 2021Updated 4 years ago
- DigitalOcean Gradient AI Platform • AdBuild production-ready AI agents using customizable tools or access multiple LLMs through a single endpoint. Create custom knowledge bases or connect external data.
- Windows kernel and user mode emulation.☆1,896Mar 12, 2026Updated 2 weeks ago
- Shoggoth: Asmjit Based Polymorphic Encryptor☆783Apr 10, 2024Updated last year
- PoCs and tools for investigation of Windows process execution techniques☆954Feb 2, 2026Updated last month
- AV/EDR evasion via direct system calls.☆1,801Sep 3, 2022Updated 3 years ago
- kill anti-malware protected processes ( BYOVD )☆969Jul 21, 2023Updated 2 years ago
- Dynamic unpacker based on PE-sieve☆799Sep 13, 2025Updated 6 months ago
- A memory-based evasion technique which makes shellcode invisible from process start to end.☆1,198Oct 16, 2023Updated 2 years ago
- HWSyscalls is a new method to execute indirect syscalls using HWBP, HalosGate and a synthetic trampoline on kernel32 with HWBP.☆721Jul 19, 2023Updated 2 years ago
- An advanced in-memory evasion technique fluctuating shellcode's memory protection between RW/NoAccess & RX and then encrypting/decrypting…☆1,098Jun 17, 2022Updated 3 years ago
- NordVPN Threat Protection Pro™ • AdTake your cybersecurity to the next level. Block phishing, malware, trackers, and ads. Lightweight app that works with all browsers.
- SysWhispers on Steroids - AV/EDR evasion via direct system calls.☆1,602Jul 31, 2024Updated last year
- laZzzy is a shellcode loader, developed using different open-source libraries, that demonstrates different execution techniques.☆500Jan 10, 2023Updated 3 years ago
- A Pin Tool for tracing API calls etc☆1,637Feb 8, 2026Updated last month
- A PoC of the ContainYourself research presented in DEFCON 31, which abuses the Windows containers framework to bypass EDRs.☆317Aug 31, 2023Updated 2 years ago
- An automation plugin for Tiny-Tracer framework to trace and watch functions directly out of the executable's import table or trace logs (…☆125Jul 12, 2024Updated last year
- RefleXXion is a utility designed to aid in bypassing user-mode hooks utilised by AV/EPP/EDR etc. In order to bypass the user-mode hooks, …☆500Jan 25, 2022Updated 4 years ago
- A proof of concept demonstrating the DLL-load proxying using undocumented Syscalls.☆413Jan 11, 2026Updated 2 months ago
- Enumerate various traits from Windows processes as an aid to threat hunting☆202Jan 13, 2022Updated 4 years ago
- Reproducing Spyboy technique to terminate all EDR/XDR/AVs processes☆1,046Jun 20, 2023Updated 2 years ago
- Virtual machines for every use case on DigitalOcean • AdGet dependable uptime with 99.99% SLA, simple security tools, and predictable monthly pricing with DigitalOcean's virtual machines, called Droplets.
- Windows rootkit for Intel x64 with 25+ features, demonstrating rootkit techniques compatible with all Windows 10 and Windows 11 versions.☆2,279Feb 15, 2026Updated last month
- Yet another variant of Process Hollowing☆461Jul 31, 2025Updated 7 months ago
- A small program written in C that is designed to load 32/64-bit shellcode and allow for execution or debugging. Can also output PE files …☆172Jul 20, 2024Updated last year
- Alternative Shellcode Execution Via Callbacks☆1,699Nov 11, 2022Updated 3 years ago
- ☆1,793Aug 30, 2024Updated last year
- Hiding shellcode in plain sight within a large memory region. Inspired by technique used by Raspberry Robin's Roshtyak☆211Nov 12, 2025Updated 4 months ago
- x64 binary obfuscator☆1,961Jul 14, 2023Updated 2 years ago