Kr0ff / WinMalDev
Various methods of executing shellcode
☆68Updated last year
Related projects ⓘ
Alternatives and complementary repositories for WinMalDev
- TypeLib persistence technique☆75Updated last month
- stack spoofing☆55Updated this week
- A PoC of Stack encryption prior to custom sleeping by leveraging CPU cycles.☆55Updated last year
- Basic implementation of Cobalt Strikes - User Defined Reflective Loader feature☆95Updated last year
- Improved version of EKKO by @5pider that Encrypts only Image Sections☆113Updated last year
- Simple ETW unhook PoC. Overwrites NtTraceEvent opcode to disable ETW at Nt-function level.☆42Updated 8 months ago
- Code snippets to add on top of cobalt strike sleep mask to achieve patchless hook on AMSI and ETW☆78Updated last year
- DLL proxy load example using the Windows thread pool API, I/O completion callback with named pipes, and C++/assembly☆58Updated 8 months ago
- This script is used to bypass DLL Hooking using a fresh mapped copy of ntdll file, patch the ETW and trigger a shellcode with process hol…☆67Updated 9 months ago
- Huffman Coding in Shellcode Obfuscation & Dynamic Indirect Syscalls Loader☆84Updated 8 months ago
- ☆34Updated last year
- Simple PoC to locate hooked functions by EDR in ntdll.dll☆32Updated last year
- Patch AMSI and ETW in remote process via direct syscall☆77Updated 2 years ago
- Splitting and executing shellcode across multiple pages☆99Updated last year
- Do some DLL SideLoading magic☆75Updated last year
- ☆35Updated last year
- Identify and exploit leaked handles for local privilege escalation.☆105Updated last year
- A newer iteration of TitanLdr with some newer hooks, and design. A generic user defined reflective DLL I built to prove a point to Mudge …☆166Updated last year
- Interceptor is a kernel driver focused on tampering with EDR/AV solutions in kernel space☆120Updated last year
- 🗡️ A multi-user malleable C2 framework targeting Windows. Written in C++ and Python☆41Updated 8 months ago
- Tool for playing with Windows Access Token manipulation.☆52Updated last year
- Indirect Syscall implementation to bypass userland NTAPIs hooking.☆55Updated 3 months ago
- Encode shellcode into dictionary words for evasion and entropy reduction☆19Updated 2 weeks ago
- abusing Process Hacker driver to terminate other processes (BYOVD)☆79Updated last year
- I have documented all of the AMSI patches that I learned till now☆68Updated last year
- Combining 3 techniques (Threadless Injection + DLL Stomping + Caro-Kann) together to evade MDE.☆38Updated 11 months ago
- Halos Gate-based NTAPI Unhooker☆49Updated 2 years ago
- Windows AppLocker Driver (appid.sys) LPE☆36Updated 3 months ago