JanielDary / weetabix
A C++ PoC implementation for enumerating Windows Fibers directly from memory
☆17Updated 6 months ago
Related projects ⓘ
Alternatives and complementary repositories for weetabix
- ☆81Updated 3 months ago
- Reimplementation of the KExecDD DSE bypass technique.☆42Updated 2 months ago
- ☆96Updated last year
- Malware?☆70Updated last month
- stack spoofing☆55Updated last week
- A improved memory obfuscation primitive using a combination of special and 'normal' Asynchronous Procedural Calls☆104Updated 2 months ago
- ☆133Updated last year
- ☆59Updated 5 months ago
- Repo that holds random POCs☆45Updated 10 months ago
- List the ETW provider(s) in the registration table of a process.☆52Updated last year
- Your NTDLL vaccine from modern direct syscall methods.☆35Updated 2 years ago
- Interceptor is a kernel driver focused on tampering with EDR/AV solutions in kernel space☆120Updated last year
- ☆106Updated last year
- TypeLib persistence technique☆75Updated last month
- Collect Windows telemetry for Maldev☆62Updated this week
- Indirect Syscall implementation to bypass userland NTAPIs hooking.☆55Updated 3 months ago
- DLL proxy load example using the Windows thread pool API, I/O completion callback with named pipes, and C++/assembly☆58Updated 8 months ago
- I have documented all of the AMSI patches that I learned till now☆68Updated last year
- Patch AMSI and ETW in remote process via direct syscall☆77Updated 2 years ago
- Combining 3 techniques (Threadless Injection + DLL Stomping + Caro-Kann) together to evade MDE.☆38Updated 11 months ago
- A newer iteration of TitanLdr with some newer hooks, and design. A generic user defined reflective DLL I built to prove a point to Mudge …☆166Updated last year
- Dynamically resolve API function addresses at runtime in a secure manner.☆45Updated last month
- A PoC for adding NtContinue to CFG allowed list in order to make Ekko work in a CFG protected process☆87Updated 2 years ago
- A Poc on blocking Procmon from monitoring network events☆98Updated 2 years ago
- Threadless shellcode injection tool☆61Updated 3 months ago
- Implementation of an export address table protection mitigation, like Export Address Filtering (EAF)☆93Updated last year
- 64bit WIndows 10 shellcode dat pops dat calc - Dynamic & Null Free☆58Updated last year
- Next gen process injection technique☆42Updated 4 years ago