Nadharm / CoVirt
A dynamically loadable virtual-machine based rootkit designed for Linux Kernel v5.13.0 using AMD-V (SVM).
☆29Updated 2 years ago
Alternatives and similar repositories for CoVirt:
Users that are interested in CoVirt are comparing it to the libraries listed below
- Hyper-V related resources☆30Updated 11 months ago
- Simple Intel VT-x type-2 hypervisor for 64-bit Linux.☆18Updated 4 years ago
- AMD SVM hypervisor rootkit proof of concept☆45Updated last year
- Full-VM taint analysis with Xen, Intel(R) Processor Trace and Triton.☆39Updated last year
- Helper script for Windows kernel debugging with IDA Pro on VMware + GDB stub (including PDB symbols)☆63Updated last year
- PEIM (UEFI) bootkit targeting OVMF (EDK2)☆33Updated last year
- A driver to implement IOCTL hooking☆24Updated 2 years ago
- Unicorn Engine port for UEFI firmware☆46Updated 2 months ago
- Helper script for Windows kernel debugging with IDA Pro on native Bochs debugger (including PDB symbols)☆61Updated last year
- LLVM Without The ROP Gadgets!☆26Updated last year
- Intel Hardware Trace Library☆66Updated 5 months ago
- Sample/PoC Windows kernel driver for detect DMA devices by using Vendor ID and Device ID signatures☆32Updated 5 months ago
- Report and exploit of CVE-2023-36427☆89Updated last year
- Hooking the GDT - Installing a Call Gate. POC for Rootkit Arsenal Book Second Edition (version 2022)☆70Updated last year
- Rust library for lifting raw binary data to LLVM IR☆44Updated last week
- Binary Ninja plugin that can be used to apply Triton's dead store eliminitation pass on basic blocks or functions.☆58Updated 7 months ago
- A thin introspection hypervisor framework that allows for low level resource manipulation.☆13Updated last year
- ☆40Updated 3 years ago
- A basic Secure Virtual Machine hypervisor☆21Updated 4 years ago
- A large collection of 32bit and 64bit PE files useful for verifying the correctness of bin2bin transformations☆50Updated 7 months ago
- Python bindings for BochsCPU☆35Updated this week
- Helper Script to convert a Windbg dumped structure (using the 'dt' command) into a C structure. It creates dummy structs for you if neede…☆26Updated last year
- Disassembler for Zeus VM custom instruction set☆27Updated last year
- Helper script for Linux kernel disassemble or debugging with IDA Pro on VMware + GDB stub (including some symbols helpers)☆36Updated last year
- Demonstrate calling a kernel function and handle process creation callback against HVCI☆52Updated 2 years ago
- Triton based symbolic emulator☆16Updated 2 years ago
- PyKD DLLs for x86 and x64 platforms☆17Updated last year
- This is the PoC of a dynamic lifter and deobfuscator with collecting trace.☆35Updated last year
- x86 and x64 assembly "read-eval-print loop" for Windows☆28Updated 7 years ago