D0pam1ne705/Direct-NtCreateUserProcess external links

---

GitHub - View repository

GitHub.dev - Open in online code editor

Star history - Growth chart over time

deps.dev - Dependencies and security vulnerabilities

Gitingest - Export source code for LLM usage

Repomix - Export source code for LLM usage

uithub - Export source code for LLM usage

Close

D0pam1ne705/Direct-NtCreateUserProcess

Readme badge preview -

If you own this repo, copy the snippet below and add it to your README.md

---

Copy

[![RelatedRepos](https://img.shields.io/badge/related-repos-yellow)](https://relatedrepos.com/gh/D0pam1ne705/Direct-NtCreateUserProcess)

Close

D0pam1ne705 / Direct-NtCreateUserProcessView on GitHubMore

• External links
• Readme badge

Call NtCreateUserProcess directly as normal.

☆77May 17, 2022Updated 3 years ago

Alternatives and similar repositories for Direct-NtCreateUserProcess

Users that are interested in Direct-NtCreateUserProcess are comparing it to the libraries listed below

• Chener-03 / AntiHook

  View on GitHub
  扫描以及恢复 r3hook 类
  ☆10Aug 29, 2021Updated 4 years ago
• waleedassar / ALPC_CLIENT_SERVER

  View on GitHub
  Demo to show how write ALPC Client & Server using native Ntdll.dll syscalls.
  ☆21Jan 25, 2022Updated 4 years ago
• huoji120 / Etw-Syscall

  View on GitHub
  https://key08.com/index.php/2021/10/19/1375.html
  ☆71May 11, 2022Updated 3 years ago
• cs1ime / DICHook

  View on GitHub
  Hook NtDeviceIoControlFile with PatchGuard
  ☆107May 10, 2022Updated 3 years ago
• Eva1216 / MagicWall

  View on GitHub
  ☆48Nov 7, 2018Updated 7 years ago
• arsium / BypassGetModuleBaseAddressAndGetExportAddress

  View on GitHub
  A proof of concept of real custom GetProcAddress and GetModuleBaseAddress
  ☆21Jul 9, 2022Updated 3 years ago
• Air14 / KDBGDecryptor

  View on GitHub
  A simple example how to decrypt kernel debugger data block
  ☆32Feb 8, 2021Updated 5 years ago
• peta909 / NtCreateUserProcess_

  View on GitHub
  ☆13Jan 21, 2019Updated 7 years ago
• fortra / CreateProcess

  View on GitHub
  A small PoC that creates processes in Windows
  ☆187Jun 6, 2024Updated last year
• boom-cr3 / NotifyRoutineHijackThread

  View on GitHub
  Hijack NotifyRoutine for a kernelmode thread
  ☆41Jun 4, 2022Updated 3 years ago
• BeneficialCode / KPPL

  View on GitHub
  Kill Protected Process Light Process (include av)
  ☆57Sep 15, 2023Updated 2 years ago
• yo-yo-yo-jbo / hotkeyz

  View on GitHub
  Hotkey-based keylogger for Windows
  ☆33Oct 17, 2024Updated last year
• bb107 / ServiceCall

  View on GitHub
  Interprocess communication library, providing the ability to call functions from each other
  ☆20Oct 3, 2019Updated 6 years ago
• secrary / Hooking-via-InstrumentationCallback

  View on GitHub
  codes for my blog post: https://secrary.com/Random/InstrumentationCallback/
  ☆182Nov 30, 2017Updated 8 years ago
• kouzhudong / AntiHook

  View on GitHub
  Enum and Remove Hook in Windows
  ☆52Dec 11, 2025Updated 3 months ago
• SolomonSklash / netntlm

  View on GitHub
  A crappy hook on SpAcceptLsaModeContext that prints incoming auth attempts. WIP
  ☆37Jul 27, 2021Updated 4 years ago
• capt-meelo / NtCreateUserProcess

  View on GitHub
  Minimal PoC developed as discuss in https://captmeelo.com/redteam/maldev/2022/05/10/ntcreateuserprocess.html
  ☆144May 10, 2022Updated 3 years ago
• MahmoudZohdy / APICallProxy

  View on GitHub
  Windows API Call Obfuscation
  ☆113Dec 9, 2022Updated 3 years ago
• WINGS2709 / 360Safe

  View on GitHub
  大数字驱动逆向代码
  ☆78Nov 4, 2023Updated 2 years ago
• moccajoghurt / MemWars

  View on GitHub
  ☆44Oct 7, 2018Updated 7 years ago
• w1u0u1 / kinject

  View on GitHub
  Kernel shellcode injector
  ☆148Mar 23, 2021Updated 4 years ago
• dearfuture / oldv-driver

  View on GitHub
  ☆14Mar 8, 2019Updated 7 years ago
• DragonQuestHero / WindowsSyscallsEx

  View on GitHub
  Quick check of NT kernel exported&unexported functions/global variable offset NT内核导出以及未导出函数+全局变量偏移速查
  ☆98Mar 30, 2023Updated 2 years ago
• 0xfei / wincode

  View on GitHub
  过去写的一些Windows安全研究相关代码
  ☆135Feb 2, 2019Updated 7 years ago
• HyperDbg / gui

  View on GitHub
  HyperDbg's Graphical User Interface (GUI)
  ☆82Feb 16, 2026Updated last month
• HadesW / mhy_exp

  View on GitHub
  Mhy Exp (exploit signed driver)
  ☆141May 17, 2022Updated 3 years ago
• MiroKaku / libwsk

  View on GitHub
  The Kernel-Mode Winsock library, supporting TCP, UDP and Unix sockets (DGRAM and STREAM).
  ☆290Jan 27, 2025Updated last year
• A-Normal-User / Pretend_HideVirtualMemory

  View on GitHub
  利用物理内存映射，实现虚拟内存的伪隐藏
  ☆86Sep 15, 2022Updated 3 years ago
• MiroKaku / Learning-Example

  View on GitHub
  For Example. See Miro's Blog
  ☆30Nov 26, 2022Updated 3 years ago
• FiYHer / InfinityHookPro

  View on GitHub
  InfinityHookPro Win7 -> Win11 latest
  ☆553Feb 7, 2023Updated 3 years ago
• omgkaka / vmp_runner

  View on GitHub
  A general solution to simulate execution of virtualized instructions (vmprotect/themida, etc.).
  ☆77Feb 9, 2022Updated 4 years ago
• neofito / RpcEndpointMapper

  View on GitHub
  Windows 7/2008 R2 EoP
  ☆13Feb 12, 2021Updated 5 years ago
• MapleSwan / enum_real_dirbase

  View on GitHub
  从MmPfnData中枚举进程和页目录基址
  ☆208Aug 18, 2023Updated 2 years ago
• kkent030315 / anycall

  View on GitHub
  x64 Windows kernel code execution via user-mode, arbitrary syscall, vulnerable IOCTLs demonstration
  ☆393Jul 6, 2022Updated 3 years ago
• janoglezcampos / c_syscalls

  View on GitHub
  Single stub direct and indirect syscalling with runtime SSN resolving for windows.
  ☆140Sep 12, 2022Updated 3 years ago
• alfarom256 / StinkyLoader

  View on GitHub
  It stinks
  ☆103Apr 22, 2022Updated 3 years ago
• 1401199262 / MemoryVirtualization

  View on GitHub
  ☆174Mar 9, 2022Updated 4 years ago
• kkent030315 / PageTableInjection

  View on GitHub
  Code Injection, Inject malicious payload via pagetables pml4.
  ☆243Jul 7, 2021Updated 4 years ago
• lxt1045 / FileLogger

  View on GitHub
  ☆12Dec 15, 2016Updated 9 years ago