Alternatives and similar repositories for VirtualEXploiter

Users that are interested in VirtualEXploiter are comparing it to the libraries listed below

• 0xflux / Hells-Hollow
  Hells Hollow Windows 11 Rootkit technique to Hook the SSDT via Alt Syscalls
  ☆206Updated 3 months ago
• gabriellandau / ItsNotASecurityBoundary
  ☆188Updated last year
• exploits-forsale / prefetch-tool
  Windows KASLR bypass using prefetch side-channel
  ☆172Updated last year
• 0xHossam / KernelCallbackTable-Injection-PoC
  Proof of Concept for manipulating the Kernel Callback Table in the Process Environment Block (PEB) to perform process injection and hijac…
  ☆264Updated last year
• hasherezade / thread_namecalling
  Process Injection using Thread Name
  ☆284Updated 8 months ago
• janoglezcampos / llvm-yx-callobfuscator
  LLVM plugin to transparently apply stack spoofing and indirect syscalls to Windows x64 native calls at compile time.
  ☆316Updated last year
• paskalian / WID_LoadLibrary
  Reverse engineering winapi function loadlibrary.
  ☆228Updated 2 years ago
• Idov31 / NovaHypervisor
  NovaHypervisor is a defensive x64 Intel host based hypervisor. The goal of this project is to protect against kernel based attacks (eithe…
  ☆237Updated 2 months ago
• connormcgarr / Vtl1Mon
  Virtual Trust Level (VTL 1) secure call tracing
  ☆83Updated 3 months ago
• keowu / Ryujin
  Ryūjin Protector - Is a Intel Arch - BIN2BIN - PE Obfuscation/Protection/DRM tool
  ☆274Updated last month
• Idov31 / EtwLeakKernel
  Leaking kernel addresses from ETW consumers. Requires Administrator privileges.
  ☆86Updated last month
• floesen / KExecDD
  Admin to Kernel code execution using the KSecDD driver
  ☆260Updated last year
• Friends-Security / RedirectThread
  Playing around with Thread Context Hijacking. Building more evasive primitives to use as alternative for existing process injection techn…
  ☆192Updated 6 months ago
• jdu2600 / CFG-FindHiddenShellcode
  Walks the CFG bitmap to find previously executable but currently hidden shellcode regions
  ☆128Updated 2 years ago
• carlos-al / user-kernel-syscall-hook
  ☆93Updated last year
• jdu2600 / EtwTi-FluctuationMonitor
  Uses Threat-Intelligence ETW events to identify shellcode regions being hidden by fluctuating memory protections
  ☆151Updated 2 years ago
• CheckPointSW / VectoredOverloading
  ☆75Updated last week
• badhive / stitch
  Rewrite and obfuscate code in compiled binaries
  ☆269Updated last week
• susMdT / LoudSunRun
  Stack Spoofing with Synthetic frames based on the work of namazso, SilentMoonWalk, and VulcanRaven
  ☆251Updated last year
• djolertrk / kovid-obfuscation-passes
  A set of LLVM and GCC based plugins that perform code obfuscation.
  ☆134Updated 2 months ago
• xrombar / flower
  a modified CONTEXT based ropchain to circumvent CFG-FindHiddenShellcode and EtwTi-FluctuationMonitor
  ☆106Updated last year
• DriverHunter / Win-Driver-EXP
  This repo contains EXPs about Vulnerable Windows Driver
  ☆46Updated last year
• Xacone / Eneio64-Driver-Exploits
  A serie of exploits targeting eneio64.sys - Turning Physical Memory R/W into Virtual Memory R/W
  ☆105Updated 2 months ago
• yardenshafir / IoRingReadWritePrimitive
  Post exploitation technique to turn arbitrary kernel write / increment into full read/write primitive on Windows 11 22H2
  ☆246Updated 3 years ago
• eversinc33 / unKover
  Anti-Rootkit/Anti-Cheat Driver to uncover unbacked or hidden kernel code.
  ☆246Updated last week
• exploits-forsale / 24h2-nt-exploit
  Exploit targeting NT kernel in 24H2 Windows Insider Preview
  ☆147Updated last year
• dmaivel / covirt
  An x86-64 code virtualizer for VM based obfuscation
  ☆155Updated 11 months ago
• hasherezade / waiting_thread_hijacking
  Waiting Thread Hijacking - injection by overwriting the return address of a waiting thread
  ☆257Updated 3 months ago
• MrAle98 / CVE-2025-21333-POC
  POC exploit for CVE-2025-21333 heap-based buffer overflow. It leverages WNF state data and I/O ring IOP_MC_BUFFER_ENTRY
  ☆225Updated 8 months ago
• NeoMaster831 / kurasagi
  Windows 11 24H2-25H2 Runtime PatchGuard Bypass
  ☆230Updated last month