A simple way to spoof return addresses using an exception handler
☆43Aug 3, 2022Updated 3 years ago
Alternatives and similar repositories for Exception-Ret-Spoofing
Users that are interested in Exception-Ret-Spoofing are comparing it to the libraries listed below
Sorting:
- Hijack NotifyRoutine for a kernelmode thread☆41Jun 4, 2022Updated 3 years ago
- Walks through the 4-level paging structures in Windows x64☆13Feb 12, 2023Updated 3 years ago
- ☆17Apr 18, 2023Updated 2 years ago
- Compileable POC of namazso's x64 return address spoofer.☆50Jun 10, 2020Updated 5 years ago
- clearing traces of a loaded driver☆47Jul 2, 2022Updated 3 years ago
- x64 assembler library☆31Jun 7, 2024Updated last year
- A proof of concept demonstrating instrumentation callbacks on Windows 10 21h1 with a TLS variable to ensure all syscalls are caught.☆157Nov 14, 2021Updated 4 years ago
- ☆12Oct 12, 2021Updated 4 years ago
- Handling C++ & __try exceptions without the need of built-in handlers.☆77Aug 28, 2021Updated 4 years ago
- A simple MmCopyMemory hook.☆38Jul 11, 2022Updated 3 years ago
- Mapping your code on a 0x1000 size page☆71May 20, 2022Updated 3 years ago
- Simple Demo of using Windows Hypervisor Platform☆29Jul 14, 2025Updated 7 months ago
- A minimalistic way to spoof return addresses without using exceptions☆17Jul 26, 2022Updated 3 years ago
- automates exploits using ROP chains, using ntdll-scraper☆16May 26, 2022Updated 3 years ago
- An example code of CiGetCertPublisherName☆17Mar 24, 2022Updated 3 years ago
- Walks the Process' VAD list to grab the PTE's corresponding to a usermode virtual address, all to get the physical address☆23Nov 22, 2021Updated 4 years ago
- https://key08.com/index.php/2021/10/19/1375.html☆71May 11, 2022Updated 3 years ago
- Experimental disassembler for x86 binaries virtualized by VMProtect 3☆99Aug 27, 2022Updated 3 years ago
- Simulate SendInput with ClassService☆35Sep 5, 2018Updated 7 years ago
- A simple example how to decrypt kernel debugger data block☆32Feb 8, 2021Updated 5 years ago
- ☆34Aug 7, 2023Updated 2 years ago
- Bypassing EasyAntiCheat.sys self-integrity by abusing call hierarchy☆83Oct 6, 2022Updated 3 years ago
- Injector with kernel power☆18Jan 2, 2021Updated 5 years ago
- This is the P.O.C source for hooking the system calls on Windows 10 (1903) using it's dynamic trace feature weakness☆53Sep 12, 2019Updated 6 years ago
- Bootkits☆19Sep 13, 2023Updated 2 years ago
- A C++ syscall ID extractor for Windows. Developed, debugged and tested on 20H2.☆21May 25, 2021Updated 4 years ago
- A general solution to simulate execution of virtualized instructions (vmprotect/themida, etc.).☆77Feb 9, 2022Updated 4 years ago
- D☆44May 3, 2021Updated 4 years ago
- Detect removed thread from PspCidTable.☆75Mar 18, 2022Updated 3 years ago
- mash hypervisor host pml4☆17Jun 22, 2022Updated 3 years ago
- this application shows EAC sdk's memory leak.☆10Nov 30, 2021Updated 4 years ago
- A simple process query/manipulation tool using driver hooked system call. (2019)☆12Aug 30, 2021Updated 4 years ago
- A better way to write shell code☆10May 28, 2021Updated 4 years ago
- Easy to include string and wstring obfuscation☆23Mar 12, 2022Updated 3 years ago
- ☆20May 17, 2022Updated 3 years ago
- ☆40Mar 23, 2023Updated 2 years ago
- Drawing from kernelmode without any hooks☆174Jul 7, 2022Updated 3 years ago
- hooking KiUserApcDispatcher☆27Apr 3, 2017Updated 8 years ago
- A kernel mode Windows rootkit in development.☆49Dec 31, 2021Updated 4 years ago