NetSPI / BOF-PE
An example reference design for a proposed BOF PE
☆126Updated last month
Alternatives and similar repositories for BOF-PE:
Users that are interested in BOF-PE are comparing it to the libraries listed below
- ☆133Updated last year
- Interceptor is a kernel driver focused on tampering with EDR/AV solutions in kernel space☆122Updated 2 years ago
- Simple POC library to execute arbitrary calls proxying them via NdrServerCall2 or similar☆129Updated 7 months ago
- The code is a pingback to the Dark Vortex blog:☆174Updated 2 years ago
- bring your own vulnerable driver☆92Updated last year
- Use hardware breakpoints to spoof the call stack for both syscalls and API calls☆190Updated 9 months ago
- Bypass LSA protection using the BYODLL technique☆155Updated 6 months ago
- Cobaltstrike Reflective Loader with Synthetic Stackframe☆101Updated 2 months ago
- ☆103Updated 2 months ago
- ☆98Updated last year
- Malware?☆69Updated 5 months ago
- I have documented all of the AMSI patches that I learned till now☆71Updated last year
- TypeLib persistence technique☆108Updated 5 months ago
- ☆112Updated 2 years ago
- Single stub direct and indirect syscalling with runtime SSN resolving for windows.☆133Updated 2 years ago
- ☆125Updated 6 months ago
- Generating legitimate call stack frame along with indirect syscalls by abusing Vectored Exception Handling (VEH) to bypass User-Land EDR …☆243Updated 7 months ago
- Exploitation of process killer drivers☆198Updated last year
- ☆61Updated 9 months ago
- Patch AMSI and ETW in remote process via direct syscall☆81Updated 2 years ago
- Huffman Coding in Shellcode Obfuscation & Dynamic Indirect Syscalls Loader.☆106Updated last year
- ☆96Updated 2 months ago
- a modified CONTEXT based ropchain to circumvent CFG-FindHiddenShellcode and EtwTi-FluctuationMonitor☆93Updated last year
- A PoC implementation for dynamically masking call stacks with timers.☆270Updated 2 years ago
- ☆119Updated last year
- Two new offensive techniques using Windows Fibers: PoisonFiber (The first remote enumeration & Fiber injection capability POC tool) Phan…☆257Updated 6 months ago
- Shellcode loader that executes embedded Lua from Rust.☆111Updated 3 months ago
- BOF with Synthetic Stackframe☆136Updated last month
- Slides for COM Hijacking AV/EDR Talk on 38c3☆72Updated 2 months ago
- Mirage is a PoC memory evasion technique that relies on a vulnerable VBS enclave to hide shellcode within VTL1.☆72Updated last month