Alternatives and similar repositories for mhy_exp

Users that are interested in mhy_exp are comparing it to the libraries listed below

• xiaoxiaozhu5 / shadow_tls

  View on GitHub
  shadow tls
  ☆17Nov 13, 2022Updated 3 years ago
• bb107 / RtlWow64

  View on GitHub
  c++ implementation of windows heavens gate
  ☆70Feb 12, 2021Updated 5 years ago
• huoji120 / Etw-Syscall

  View on GitHub
  https://key08.com/index.php/2021/10/19/1375.html
  ☆71May 11, 2022Updated 3 years ago
• D0pam1ne705 / Direct-NtCreateUserProcess

  View on GitHub
  Call NtCreateUserProcess directly as normal.
  ☆76May 17, 2022Updated 3 years ago
• BeneficialCode / KPPL

  View on GitHub
  Kill Protected Process Light Process (include av)
  ☆58Sep 15, 2023Updated 2 years ago
• A-Normal-User / Pretend_HideVirtualMemory

  View on GitHub
  利用物理内存映射，实现虚拟内存的伪隐藏
  ☆86Sep 15, 2022Updated 3 years ago
• Sinclairq / hierarchy-eac

  View on GitHub
  Bypassing EasyAntiCheat.sys self-integrity by abusing call hierarchy
  ☆83Oct 6, 2022Updated 3 years ago
• FiYHer / driver_callback_bypass_1909

  View on GitHub
  研究和移除各种内核回调,在anti anti cheat的路上越走越远
  ☆183Aug 26, 2022Updated 3 years ago
• iammaguire / Salient-Rootkit

  View on GitHub
  A kernel mode Windows rootkit in development.
  ☆49Dec 31, 2021Updated 4 years ago
• alfarom256 / UserVAtoPhysical

  View on GitHub
  Walks the Process' VAD list to grab the PTE's corresponding to a usermode virtual address, all to get the physical address
  ☆23Nov 22, 2021Updated 4 years ago
• qq1045551070 / VtToMe

  View on GitHub
  之前学习X64VT写的代码，很多坑，但是大体的逻辑还是完整的。现发出来给更多想学VT的人参考...
  ☆71Apr 26, 2021Updated 4 years ago
• 0xfei / wincode

  View on GitHub
  过去写的一些Windows安全研究相关代码
  ☆135Feb 2, 2019Updated 7 years ago
• KelvinMsft / ThreadSpy

  View on GitHub
  ☆163Oct 29, 2020Updated 5 years ago
• sum-catnip / kptnhook

  View on GitHub
  windows kernelmode driver to inject dll into each and every process and perform systemwide function hooking
  ☆53Aug 28, 2022Updated 3 years ago
• fIappy / infhook19041

  View on GitHub
  ☆127May 23, 2020Updated 5 years ago
• FiYHer / InfinityHookPro

  View on GitHub
  InfinityHookPro Win7 -> Win11 latest
  ☆551Feb 7, 2023Updated 3 years ago
• KiFilterFiberContext / warbird-hook

  View on GitHub
  Using Microsoft Warbird to automatically unpack and execute encrypted shellcode in ClipSp.sys without triggering PatchGuard
  ☆265Aug 31, 2022Updated 3 years ago
• aaaddress1 / wow64Jit

  View on GitHub
  Call 32bit NtDLL API directly from WoW64 Layer
  ☆62Nov 18, 2020Updated 5 years ago
• chkpizza / runtime

  View on GitHub
  VEH Redirect & VEH Debugger
  ☆23May 18, 2020Updated 5 years ago
• hackerhouse-opensource / envschtasksuacbypass

  View on GitHub
  Bypass UAC elevation on Windows 8 (build 9600) & above.
  ☆57Feb 2, 2026Updated last week
• jackullrich / syscall-detect

  View on GitHub
  PoC capable of detecting manual syscalls from usermode.
  ☆206Nov 13, 2025Updated 3 months ago
• NoOne-hub / Beacon.dll

  View on GitHub
  Beacon.dll reverse
  ☆141Sep 5, 2021Updated 4 years ago
• huoji120 / cpu_duck

  View on GitHub
  关于intel和amd指令行为不一样这件事
  ☆62Apr 15, 2022Updated 3 years ago
• zouxianyu / BlindEye

  View on GitHub
  BattlEye kernel module bypass
  ☆178Oct 1, 2022Updated 3 years ago
• timwhitez / Doge-Whisper

  View on GitHub
  golang implementation of Syswhisper2/Syswhisper3
  ☆23Mar 23, 2022Updated 3 years ago
• gabriellandau / CISpotter

  View on GitHub
  Code Integrity Violation Spotter
  ☆17Jun 11, 2024Updated last year
• smallzhong / hide_execute_memory

  View on GitHub
  隐藏可执行内存
  ☆267Apr 27, 2025Updated 9 months ago
• TimelifeCzy / kHypervisorBasic

  View on GitHub
  VT Hook
  ☆50Jul 2, 2024Updated last year
• veryboreddd / Return-address-spoofer

  View on GitHub
  Illustrates the concept of return address spoofing, and how it is used.
  ☆14May 13, 2020Updated 5 years ago
• y11en / PEBFake

  View on GitHub
  PEBFake(修改PEB 伪装当前进程路径、参数等)
  ☆53Jan 19, 2021Updated 5 years ago
• Rhydon1337 / windows-kernel-file-delete

  View on GitHub
  Force a file delete using a windows kernel driver
  ☆72Jul 29, 2022Updated 3 years ago
• FaEryICE / MemScanner

  View on GitHub
  Analyze Windows x64 Kernel Memory Layout
  ☆129Nov 19, 2020Updated 5 years ago
• Rvn0xsy / SchtaskCreator

  View on GitHub
  远程创建任务计划工具
  ☆190Apr 23, 2022Updated 3 years ago
• LloydLabs / delete-self-poc

  View on GitHub
  A way to delete a locked file, or current running executable, on disk.
  ☆616Nov 5, 2025Updated 3 months ago
• HadesW / dwm-overlay

  View on GitHub
  Top level overlay drawing for game cheating using dwm.exe
  ☆47Oct 26, 2021Updated 4 years ago
• gmh5225 / CallMeWin32kDriver

  View on GitHub
  Load your driver like win32k.sys
  ☆258Aug 20, 2022Updated 3 years ago
• crvvdev / MasterHide

  View on GitHub
  A x64 Windows Rootkit using SSDT or Hypervisor hook
  ☆564Jan 4, 2025Updated last year
• bluesadi / Pluto

  View on GitHub
  Obfuscator based on LLVM 14.0.6
  ☆891Nov 21, 2024Updated last year
• PI-Defender / pi-defender

  View on GitHub
  Kernel Security driver used to block past, current and future process injection techniques on Windows Operating System.
  ☆154Sep 11, 2022Updated 3 years ago