Midi12 / QueryWorkingSetExample
Just an example of a well-known technique to detect memory tampering via Windows Working Sets.
☆16Updated 3 years ago
Alternatives and similar repositories for QueryWorkingSetExample:
Users that are interested in QueryWorkingSetExample are comparing it to the libraries listed below
- A library for intel VT-x hypervisor functionality supporting EPT shadowing.☆48Updated 3 years ago
- Anti-Analysis technique, trick the debugger by Hiding events from it.☆19Updated 3 years ago
- UnknownField is a tool based clang that obfuscating the order of fields to protect your C/C++ game or code.☆44Updated last year
- ☆16Updated last year
- WinHvShellcodeEmulator (WHSE) is a shellcode emulator leveraging the Windows Hypervisor Platform API☆22Updated 2 years ago
- Walks the Process' VAD list to grab the PTE's corresponding to a usermode virtual address, all to get the physical address☆24Updated 3 years ago
- ☆24Updated 5 years ago
- Hijack NotifyRoutine for a kernelmode thread☆41Updated 2 years ago
- Windows driver template, using C++20 & cmake & GithubActions☆20Updated 5 months ago
- windows kernel pagehook☆39Updated 2 years ago
- ollvm 4.0 using clang 10.0.1☆13Updated 3 years ago
- Wow64 Heaven's Gate Hook☆28Updated 3 years ago
- Helper script for Windows kernel debugging with IDA Pro on VMware + GDB stub (including PDB symbols)☆62Updated last year
- RET / JMP RBX call spoofer☆9Updated 5 years ago
- Protected Process Light Library☆18Updated 4 years ago
- ☆58Updated 2 years ago
- Example of hijacking system calls via function pointer tables☆32Updated 3 years ago
- direct systemcalls with a modern c++20 interface.☆42Updated 2 years ago
- ☆29Updated 3 years ago
- Translates WinDbg "dt" structure dump to a C structure☆13Updated 4 years ago
- x64 assembler library☆32Updated 7 months ago
- Helper Script to convert a Windbg dumped structure (using the 'dt' command) into a C structure. It creates dummy structs for you if neede…☆26Updated last year
- detect hypervisor with Nmi Callback☆34Updated 2 years ago
- A poc that abuses Enclave☆36Updated 2 years ago
- win32/x64 obfuscate framework☆32Updated 5 years ago
- ☆26Updated 3 years ago
- A native Windows library for intercepting kernel-to-user transitions using instrumentation callbacks☆16Updated 11 months ago
- Data and structures regarding the research done on WdFilter☆13Updated 4 years ago
- Library for using direct system calls☆35Updated 4 years ago