A proof of concept demonstrating instrumentation callbacks on Windows 10 21h1 with a TLS variable to ensure all syscalls are caught.
☆168Nov 14, 2021Updated 4 years ago
Alternatives and similar repositories for instrumentation_callbacks
Users that are interested in instrumentation_callbacks are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- An x64 page table iterator written in C++ as a kernel mode windows driver.☆123May 25, 2021Updated 5 years ago
- A C++ syscall ID extractor for Windows. Developed, debugged and tested on 20H2.☆22May 25, 2021Updated 5 years ago
- Illustrates the concept of return address spoofing, and how it is used.☆14May 13, 2020Updated 6 years ago
- Kernel driver for detecting Intel VT-x hypervisors.☆202Jul 11, 2023Updated 3 years ago
- Allows you to communicate with the kernel mode to manipulate memory in a stealthy way to avoid kernel anticheats.☆169May 8, 2022Updated 4 years ago
- Simple, predictable pricing with DigitalOcean hosting • AdAlways know what you'll pay with monthly caps and flat pricing. Enterprise-grade infrastructure trusted by 600k+ customers.
- This program remaps its image to prevent the page protection of pages contained in the image from being modified via NtProtectVirtualMemo…☆640Mar 19, 2019Updated 7 years ago
- ☆156May 21, 2024Updated 2 years ago
- based on https://github.com/secrary/Hooking-via-InstrumentationCallback☆70Oct 29, 2019Updated 7 years ago
- Handling C++ & __try exceptions without the need of built-in handlers.☆76Aug 28, 2021Updated 5 years ago
- Hygieia, a vulnerable driver traces scanner written in C++ as an x64 Windows kernel driver.☆155Feb 12, 2022Updated 4 years ago
- mouseclassservicecallback detection via hook☆54Feb 7, 2022Updated 4 years ago
- Hook NtDeviceIoControlFile with PatchGuard☆103May 10, 2022Updated 4 years ago
- base for testing☆201Sep 28, 2024Updated 2 years ago
- 从MmPfnData中枚举进程和页目录基址☆230Aug 18, 2023Updated 3 years ago
- GPU virtual machines on DigitalOcean Gradient AI • AdGet to production fast with high-performance AMD and NVIDIA GPUs you can spin up in seconds. The definition of operational simplicity.
- Emulate Drivers in RING3 with self context mapping or unicorn☆394Aug 18, 2022Updated 4 years ago
- Kernel DLL Injector using NX Bit Swapping and VAD hide for hiding injected DLL☆221Nov 12, 2020Updated 5 years ago
- nmi stackwalking + module verification☆186Dec 28, 2023Updated 2 years ago
- This tool will allow you to spoof the return addresses of your functions as well as system functions.☆585Nov 12, 2022Updated 3 years ago
- Finding Truth in the Shadows☆126Jan 26, 2023Updated 3 years ago
- ☆191Dec 8, 2021Updated 4 years ago
- A mapper that maps shellcode into loaded large page drivers☆374Apr 26, 2022Updated 4 years ago
- A simple example how to decrypt kernel debugger data block☆32Feb 8, 2021Updated 5 years ago
- BattlEye shellcodes tester☆155Jan 3, 2022Updated 4 years ago
- 1-Click AI Models by DigitalOcean Gradient • AdDeploy popular AI models on DigitalOcean Gradient GPU virtual machines with just a single click. Zero configuration with optimized deployments.
- Kernel driver that .text hooks a syscall in dxgkrnl.sys which can be called from our user-mode client to send instructions like rpm/wpm a…☆237Dec 16, 2022Updated 3 years ago
- 🪝 Various EPT hook detection approaches☆161Feb 22, 2026Updated 8 months ago
- Walks the Process' VAD list to grab the PTE's corresponding to a usermode virtual address, all to get the physical address☆23Nov 22, 2021Updated 4 years ago
- Detect-KeAttachProcess by iterating through all processes as well as checking the context of the thread.☆120Feb 8, 2022Updated 4 years ago
- ☆101Oct 6, 2017Updated 9 years ago
- Hex-Rays microcode plugin for automated simplification of Windows Kernel decompilation.☆682Jan 28, 2025Updated last year
- Disks for DMA☆159Apr 28, 2021Updated 5 years ago
- 09/2021 reversal of EasyAntiCheat driver☆246Dec 21, 2021Updated 4 years ago
- Use ci.dll API for validating Authenticode signature of files☆171Mar 28, 2022Updated 4 years ago
- Serverless GPU API endpoints on Runpod - Get Bonus Credits • AdSkip the infrastructure headaches. Auto-scaling, pay-as-you-go, no-ops approach lets you focus on innovating your application.
- Hooking Windows' exception dispatcher to protect process's PML4☆276Jan 24, 2025Updated last year
- Browse Page Tables on Windows (Page Table Viewer)☆242Apr 2, 2022Updated 4 years ago
- Code for Battleyes shellcode☆232Nov 11, 2021Updated 4 years ago
- x64 Windows kernel code execution via user-mode, arbitrary syscall, vulnerable IOCTLs demonstration☆427Jul 6, 2022Updated 4 years ago
- A library for intel VT-x hypervisor functionality supporting EPT shadowing.☆52Mar 11, 2021Updated 5 years ago
- Enumerate various traits from Windows processes as an aid to threat hunting☆197Jan 13, 2022Updated 4 years ago
- Lightweight Intel VT-x Hypervisor.☆750Sep 3, 2026Updated last month