Alternatives and similar repositories for Hooker:

Users that are interested in Hooker are comparing it to the libraries listed below

• ioncodes / SilentLoad
  "Service-less" driver loading
  ☆152Updated 4 months ago
• 0xsch1zo / NullGate
  Library that eases the use of indirect syscalls. Quite interesting AV/EDR bypass as PoC.
  ☆90Updated last month
• MythicAgents / Hannibal
  A Mythic Agent written in PIC C.
  ☆186Updated 2 months ago
• rad9800 / FileRenameJunctionsEDRDisable
  ☆154Updated 4 months ago
• silentwarble / PIC-Library
  A collection of position independent coding resources
  ☆68Updated 2 months ago
• NUL0x4C / FetchPayloadFromDummyFile
  Construct the payload at runtime using an array of offsets
  ☆63Updated 9 months ago
• eversinc33 / PSXecute
  MIPS VM to execute payloads without allocating executable memory. Based on a PlayStation 1 (PSX) Emulator.
  ☆112Updated 4 months ago
• Idov31 / NidhoggScript
  NidhoggScript is a tool to generate "script" file that allows execution of multiple commands for Nidhogg
  ☆46Updated last year
• oldboy21 / JayFinder
  Find DLLs with RWX section
  ☆79Updated last year
• Faran-17 / Hellshazzard
  Indirect Syscall implementation to bypass userland NTAPIs hooking.
  ☆74Updated 8 months ago
• boku7 / patchwerk
  BOF that finds all the Nt* system call stubs within NTDLL and overwrites with clean syscall stubs (user land hook evasion)
  ☆171Updated 2 months ago
• akamai / Mirage
  Mirage is a PoC memory evasion technique that relies on a vulnerable VBS enclave to hide shellcode within VTL1.
  ☆74Updated last month
• ZERODETECTION / MSC_Dropper
  ☆152Updated 8 months ago
• paranoidninja / BRC4-BOF-Artillery
  ☆104Updated 3 weeks ago
• rbmm / SC_DEMO
  ☆113Updated last month
• ViperXSecurity / lib-nosa
  lib-nosa is a minimalist C library designed to facilitate socket connections through AFD driver IOCTL operations on Windows.
  ☆108Updated 7 months ago
• Offensive-Panda / DV_NEW
  This is the combination of multiple evasion techniques to evade defenses. (Dirty Vanity)
  ☆47Updated 11 months ago
• xforcered / Being-A-Good-CLR-Host
  ☆102Updated 3 months ago
• xforcered / ForsHops
  ForsHops
  ☆98Updated 3 weeks ago
• NtDallas / Svartalfheim
  Stage 0
  ☆155Updated 4 months ago
• JanielDary / ImmoralFiber
  Two new offensive techniques using Windows Fibers: PoisonFiber (The first remote enumeration & Fiber injection capability POC tool) Phan…
  ☆258Updated 7 months ago
• jakobfriedl / BenevolentLoader
  Shellcode loader using direct syscalls via Hell's Gate and payload encryption.
  ☆90Updated 10 months ago
• decoder-it / ChgPass
  ☆128Updated 2 months ago
• naksyn / Embedder
  Embedder is a collection of sources in different languages to embed Python interpreter with minimal dependencies
  ☆118Updated 10 months ago
• x0reaxeax / PageSplit
  Splitting and executing shellcode across multiple pages
  ☆100Updated last year
• synacktiv / DLHell
  Local & remote Windows DLL Proxying
  ☆164Updated 10 months ago
• tdeerenberg / InlineWhispers3
  Tool for working with Indirect System Calls in Cobalt Strike's Beacon Object Files (BOF) using SysWhispers3 for EDR evasion
  ☆14Updated last week
• rbmm / SC
  shell code example
  ☆34Updated last month
• Cracked5pider / earlycascade-injection
  early cascade injection PoC based on Outflanks blog post
  ☆213Updated 5 months ago
• ricardojoserf / NativeBypassCredGuard
  Bypass Credential Guard by patching WDigest.dll using only NTAPI functions
  ☆236Updated last week