NotokDay / NTProcessInjector
Process injection via native Windows APIs (NTAPIs)
☆15Updated last year
Alternatives and similar repositories for NTProcessInjector:
Users that are interested in NTProcessInjector are comparing it to the libraries listed below
- ☆26Updated 3 months ago
- A pure C version of SymProcAddress☆24Updated 10 months ago
- Reimplementation of the KExecDD DSE bypass technique.☆46Updated 4 months ago
- a simple poc showcasing the ability of an admin to suspend EDR's protected processes , making it useless☆39Updated 6 months ago
- Process Ghosting is a technique in which a process is created from a delete pending file. This means the created process is not backed by…☆14Updated 8 months ago
- Dumping LSASS by Unhooking MiniDumpWriteDump by getting a fresh DbgHelp.dll copy from the disk , plus functions and strings obfuscation☆30Updated 2 years ago
- API Hammering with C++20☆44Updated 2 years ago
- Experimental PoC for unhooking API functions using in-memory patching, without VirtualProtect, for one specific EDR.☆39Updated last year
- ☆24Updated 2 weeks ago
- HEVD Exploit: ArbitraryWrite on Windows 10 22H2 - Bypassing KVA Shadow and SMEP via PML4 Entry Manipulation☆22Updated 6 months ago
- Research into removing strings & API call references at compile-time (Anti-Analysis)☆24Updated 7 months ago
- RunPE adapted for x64 and written in C, does not use RWX☆24Updated 8 months ago
- Indirect Syscall implementation to bypass userland NTAPIs hooking.☆73Updated 5 months ago
- Your NTDLL vaccine from modern direct syscall methods.☆35Updated 2 years ago
- the Open Source and Pure C++ Packer for eXecutables☆18Updated last year
- A more reliable way of resolving syscall numbers in Windows☆50Updated 11 months ago
- Piece of code to detect and remove hooks in IAT☆62Updated 2 years ago
- Just another ntdll unhooking using Parun's Fart technique☆73Updated last year
- ☆29Updated last month
- ☆58Updated last year
- Red Team Operation's Defense Evasion Technique.☆52Updated 7 months ago
- Windows AppLocker Driver (appid.sys) LPE☆47Updated 5 months ago
- Detect userland hooks placed by AV/EDR☆27Updated last year
- NidhoggScript is a tool to generate "script" file that allows execution of multiple commands for Nidhogg☆46Updated 10 months ago
- Section-based payload obfuscation technique for x64☆59Updated 5 months ago
- Self Delete DLL☆23Updated 11 months ago
- ☆68Updated 5 months ago
- An example of COM hijacking using a proxy DLL.☆25Updated 3 years ago
- RDLL for Cobalt Strike beacon to silence sysmon process☆87Updated 2 years ago