Alternatives and similar repositories for AntiHook:

Users that are interested in AntiHook are comparing it to the libraries listed below

• NtRaiseHardError / Dreadnought
  PoC for detecting and dumping code injection (built and extended on UnRunPE)
  ☆56Updated 6 years ago
• 3gstudent / Inject-dll-by-Process-Doppelganging
  Process Doppelgänging
  ☆156Updated 7 years ago
• NtRaiseHardError / Anti-Delete
  Protects deletion of files with a specified extension using a kernel-mode driver.
  ☆75Updated 6 years ago
• 86hh / DreamLoader
  Simple 32/64-bit PEs loader.
  ☆136Updated 6 years ago
• 3gstudent / HiddenNtRegistry
  Use NT Native Registry API to create a registry that normal user can not query.
  ☆57Updated 7 years ago
• DownWithUp / DynamicKernelShellcode
  An example of how x64 kernel shellcode can dynamically find and use APIs
  ☆104Updated 4 years ago
• hoangprod / DanSpecial
  Weaponizing Gigabyte driver for priv escalation and bypass PPL
  ☆68Updated 5 years ago
• hasherezade / process_chameleon
  A process overwriting its own PEB to make an illusion that it has been loaded from a different path.
  ☆93Updated 3 years ago
• jackullrich / TRunPE
  A modified RunPE (process hollowing) technique avoiding the usage of SetThreadContext by appending a TLS section which calls the original…
  ☆93Updated 5 years ago
• JKornev / hijacken
  Analyze and attack windows applications using dll hijacking vulnerabilities
  ☆56Updated 5 years ago
• NtRaiseHardError / UnRunPE
  PoC for detecting and dumping process hollowing code injection
  ☆51Updated 6 years ago
• NtRaiseHardError / NINA
  NINA: No Injection, No Allocation x64 Process Injection Technique
  ☆195Updated 4 years ago
• killswitch-GUI / HotLoad-Driver
  C++
  ☆80Updated 8 years ago
• uvbs / NT-APC-Injector
  APC DLL Injector with NtQueueApcThread and wake up thread support
  ☆42Updated 7 years ago
• hasherezade / libpeconv_tpl
  A ready-made template for a project based on libpeconv.
  ☆43Updated 3 months ago
• djhohnstein / ProcessReimaging
  Process reimaging proof of concept code
  ☆95Updated 5 years ago
• idan1288 / ProcessHollowing32-64
  Process Hollowing for 32 bit and 64 bit
  ☆81Updated 7 years ago
• WithSecureLabs / doublepulsar-usermode-injector
  A utility to use the usermode shellcode from the DOUBLEPULSAR payload to reflectively load an arbitrary DLL into another process, for use…
  ☆117Updated 7 years ago
• NtRaiseHardError / Kaiser
  Fileless persistence, attacks and anti-forensic capabilties.
  ☆90Updated 6 years ago
• ufrisk / shellcode64
  A minimal tool to extract shellcode from 64-bit PE binaries.
  ☆50Updated 3 years ago
• WithSecureLabs / ModuleStomping
  https://blog.f-secure.com/hiding-malicious-code-with-module-stomping/
  ☆118Updated 5 years ago
• hlldz / APC-PPID
  Adds a user-mode asynchronous procedure call (APC) object to the APC queue of the specified thread and spoof the Parent Process.
  ☆156Updated 5 years ago
• maldevel / driver-loader
  Load a Windows Kernel Driver
  ☆91Updated 7 years ago
• mattifestation / PoCSubjectInterfacePackage
  A proof-of-concept subject interface package (SIP) used to demonstrate digital signature subversion attacks.
  ☆95Updated 7 years ago
• FuzzySecurity / Driver-Template
  Bare template for a Kernel Mode Driver
  ☆51Updated 4 years ago
• SouhailHammou / KernelSymbolsHelper
  Retrieve pointers to undocumented kernel functions and offsets to members within undocumented structures to use in your driver by using t…
  ☆53Updated 5 years ago
• DanielAvinoam / TheSubZeroProject
  A multi-staged malware that contains a kernel mode rootkit and a remote system shell.
  ☆72Updated 3 years ago
• SouhailHammou / Drivers
  Windows Drivers
  ☆97Updated 5 years ago
• bytecode77 / slui-file-handler-hijack-privilege-escalation
  Slui File Handler Hijack UAC Bypass Local Privilege Escalation
  ☆89Updated 2 years ago
• n00bk1t / n00bk1t
  ☆56Updated 10 years ago