PorLaCola25 / PPID-Spoofing
POC of PPID spoofing using NtCreateUserProcess with syscalls to create a suspended process and performing process injection by overwritting ntdll:LdrInitializeThunk with shellcode.
☆38Updated 3 years ago
Related projects ⓘ
Alternatives and complementary repositories for PPID-Spoofing
- A PoC tool for exploiting leaked process and thread handles☆30Updated 9 months ago
- ☆53Updated 2 years ago
- ☆26Updated 2 years ago
- ☆49Updated 4 years ago
- ☆58Updated 2 years ago
- C++ implementation of DOUBLEPULSAR usermode shellcode. Yet another Reflective DLL loader.☆29Updated 3 years ago
- Protected Process (Light) Dump: Uses Zemana AntiMalware Engine To Open a Privileged Handle to a PP/PPL Process And Inject MiniDumpWriteDu…☆22Updated 4 years ago
- Unhooks Bit Defender from NTDLL and KERNELBASE using a classic technique.☆53Updated last year
- RunPE using Hell's Gate technique.☆31Updated 3 years ago
- Demo to show how write ALPC Client & Server using native Ntdll.dll syscalls.☆20Updated 2 years ago
- Get your data from the resource section manually, with no need for windows apis☆53Updated last month
- This is a simple project made to evade https://github.com/thefLink/Hunt-Sleeping-Beacons by using a busy wait instead of beacon's built i…☆30Updated 2 years ago
- x64 version☆30Updated 3 years ago
- HookDetection☆44Updated 3 years ago
- A kernel mode Windows rootkit in development.☆49Updated 2 years ago
- A crappy hook on SpAcceptLsaModeContext that prints incoming auth attempts. WIP☆33Updated 3 years ago
- IAT-Obfuscation to make static analysis of executable harder.☆41Updated 3 years ago
- An Obfuscator-LLVM based mingw-w64 toolchain.☆17Updated 2 years ago
- Bypass UAC elevation on Windows 8 (build 9600) & above.☆53Updated 2 years ago
- A Study in Obfuscation: Analyzing the effect of various techniques to bypass AV engines☆41Updated 2 years ago
- Artemis - C++ Hell's Gate Syscall Implementation☆30Updated last year
- Hijack Printconfig.dll to execute shellcode☆98Updated 3 years ago
- Injects shellcode into remote processes using direct syscalls☆74Updated 3 years ago
- ☆37Updated last year
- Kernel file/process/object tool☆64Updated 3 years ago
- Windows RPC example calling stubs generated from MS-LSAT and MS-LSAD☆24Updated 10 months ago
- ksc4cpp is a shellcode framework for windows kernel based on C++☆21Updated last year