C485/ReturnAddressHider external links

---

GitHub - View repository

GitHub.dev - Open in online code editor

Star history - Growth chart over time

deps.dev - Dependencies and security vulnerabilities

Gitingest - Export source code for LLM usage

Repomix - Export source code for LLM usage

uithub - Export source code for LLM usage

Close

C485/ReturnAddressHider

Readme badge preview -

If you own this repo, copy the snippet below and add it to your README.md

---

Copy

[![RelatedRepos](https://img.shields.io/badge/related-repos-yellow)](https://relatedrepos.com/gh/C485/ReturnAddressHider)

Close

C485 / ReturnAddressHiderView on GitHubMore

• External links
• Readme badge

Simple header only library to change return address on current stack frame.

☆22Sep 4, 2016Updated 9 years ago

Alternatives and similar repositories for ReturnAddressHider

Users that are interested in ReturnAddressHider are comparing it to the libraries listed below

• tinysec / runwithdll

  View on GitHub
  windows create process with a dll load first time via LdrHook
  ☆31Oct 21, 2016Updated 9 years ago
• SLAUC91 / SDS

  View on GitHub
  Software Distribution Service
  ☆12Jul 2, 2015Updated 10 years ago
• changeofpace / Remote-Process-Cookie-for-Windows-7

  View on GitHub
  Obtain remote process cookies by performing a brute-force attack on ntdll.RtlDecodePointer using known pointer encodings.
  ☆23May 31, 2017Updated 8 years ago
• jnastarot / cleancall

  View on GitHub
  Library for using direct system calls
  ☆35Jan 30, 2025Updated last year
• aaaddress1 / APCInjector-BYPASS-AV

  View on GitHub
  ☆19Jul 20, 2015Updated 10 years ago
• johnsonjason / Remote-Thread-Executor

  View on GitHub
  Code injection by hijacking threads in Windows 32-bit applications
  ☆44Oct 3, 2018Updated 7 years ago
• Microwave89 / injector

  View on GitHub
  Code Injector Using Code Caves
  ☆15Jul 12, 2015Updated 10 years ago
• NtRaiseHardError / MIST

  View on GitHub
  Minimal Intervention and Software Transformation - PoC Packer designed for AV detection bypass
  ☆18Nov 4, 2017Updated 8 years ago
• pcguru34 / windbgshark

  View on GitHub
  Automatically exported from code.google.com/p/windbgshark
  ☆12Nov 3, 2015Updated 10 years ago
• tcpie / hook_any_x64

  View on GitHub
  Easily hook WIN32 x64 functions
  ☆18Feb 19, 2025Updated last year
• int0 / ProcessIsolator

  View on GitHub
  ☆82Dec 3, 2017Updated 8 years ago
• wyyqyl / HideModule

  View on GitHub
  The dll that can hide itself and then delete itselft.
  ☆32Mar 31, 2013Updated 12 years ago
• AzureGreen / WinNT-Learning

  View on GitHub
  Notes my learning steps about Windows-NT
  ☆23May 18, 2017Updated 8 years ago
• NtRaiseHardError / LeakMyAV

  View on GitHub
  Program to leak anti-virus behaviour and such
  ☆14Apr 18, 2019Updated 6 years ago
• adi97ida / Client

  View on GitHub
  ☆12Nov 17, 2014Updated 11 years ago
• mike024wk / KeHook64

  View on GitHub
  Kernel Hook X64
  ☆26Oct 11, 2020Updated 5 years ago
• VeroFess / X64SystemCall

  View on GitHub
  All Nt Syscall and W32k Syscall in one asm, include, and call it!
  ☆58Nov 4, 2021Updated 4 years ago
• KelvinMsft / NoTruth

  View on GitHub
  ☆99Oct 6, 2017Updated 8 years ago
• revsic / BranchTracer

  View on GitHub
  Branch based windows debugger
  ☆22Jul 30, 2019Updated 6 years ago
• Ynob2000 / pvC

  View on GitHub
  ☆15Oct 7, 2020Updated 5 years ago
• KelvinMsft / ScreenCapAttack

  View on GitHub
  ☆36Oct 29, 2020Updated 5 years ago
• tandasat / RemoteWriteMonitor

  View on GitHub
  A tool to help malware analysts tell that the sample is injecting code into other process.
  ☆78Aug 12, 2015Updated 10 years ago
• Synestraa / Highcall-Library

  View on GitHub
  usermode standalone kernel interface
  ☆111Jul 9, 2018Updated 7 years ago
• mq1n / Wow64SyscallHook

  View on GitHub
  Wow64 syscall hook
  ☆43May 28, 2017Updated 8 years ago
• Microwave89 / syscalltest

  View on GitHub
  PoC for Bypassing UM Hooks By Bruteforcing Intel Syscalls
  ☆39Nov 20, 2015Updated 10 years ago
• redplait / pexphide

  View on GitHub
  PoC for hiding PE exports
  ☆67Dec 19, 2020Updated 5 years ago
• GravitLauncher / Avanguard

  View on GitHub
  fork HoShiMin Avanguard
  ☆20Sep 29, 2018Updated 7 years ago
• HoShiMin / AriadnaProject

  View on GitHub
  🧶 The Win32 usermode threading library with UMS/fibers/threads support
  ☆30Jul 1, 2019Updated 6 years ago
• zibility / Anti-Rootkits

  View on GitHub
  内核级ARK工具。
  ☆62Aug 1, 2016Updated 9 years ago
• addrianyy / asmlib_x64

  View on GitHub
  x64 assembler library
  ☆31Jun 7, 2024Updated last year
• j321521621 / pipemonitor

  View on GitHub
  管道监视器,类似于spyxx之类的东西,一般用于监视目标进程的系统调用.关键词:detours+piep
  ☆23Feb 26, 2014Updated 12 years ago
• majian55555 / MJAntiVirusEngine

  View on GitHub
  Anti-virus engine in Windows using VC++ 6.0 and MFC. We applied windows multithreading in virus scan method and user interface. Using MFC…
  ☆16Oct 21, 2016Updated 9 years ago
• ldebug / ObRegisterCallBacksByPass

  View on GitHub
  Modify process handle permissions
  ☆61Nov 30, 2016Updated 9 years ago
• secrary / Hooking-via-InstrumentationCallback

  View on GitHub
  codes for my blog post: https://secrary.com/Random/InstrumentationCallback/
  ☆182Nov 30, 2017Updated 8 years ago
• isoadam / gina_public

  View on GitHub
  Prototype of hijacking Windows driver dispatch routines in unmapped discardable sections
  ☆55Mar 30, 2019Updated 6 years ago
• osiris123 / CDriver_Loader

  View on GitHub
  Kernel mode driver loader, injecting into the windows kernel, Rootkit. Driver injections.
  ☆47Nov 9, 2014Updated 11 years ago
• h4xu3lyn / FuckPg

  View on GitHub
  Analysing and defeating PatchGuard universally
  ☆36Nov 4, 2020Updated 5 years ago
• Midi12 / drv-loader

  View on GitHub
  Simple driver loader for windows
  ☆18May 22, 2020Updated 5 years ago
• FrankStain / pe-loader

  View on GitHub
  library, which help to describe or load and execute PE files.
  ☆55Jun 23, 2013Updated 12 years ago