This script is used to bypass DLL Hooking using a fresh mapped copy of ntdll file, patch the ETW and trigger a shellcode with process hollowing
☆74Feb 11, 2024Updated 2 years ago
Alternatives and similar repositories for UnhookingDLL
Users that are interested in UnhookingDLL are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- really ?☆12Feb 29, 2024Updated 2 years ago
- ZwProcessHollowing is a x64 process hollowing project which uses direct systemcalls, dll unhooking and RC4 payload decryption☆98Mar 23, 2023Updated 3 years ago
- Herpaderply Hollowing - a PE injection technique, hybrid between Process Hollowing and Process Herpaderping☆69Oct 9, 2022Updated 4 years ago
- Malware dev tricks. Syscalls part 1. Simple C example☆12Jun 8, 2023Updated 3 years ago
- NativePayload_PE1/PE2 , Injecting Meterpreter Payload bytes into local Process via Delegation Technique + in-memory with delay Changing R…☆56Jun 6, 2023Updated 3 years ago
- Managed hosting for WordPress and PHP on Cloudways • AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- Replace the .txt section of the current loaded modules from \KnownDlls\☆308Sep 28, 2022Updated 4 years ago
- Code snippets to add on top of cobalt strike sleep mask to achieve patchless hook on AMSI and ETW☆87Mar 19, 2023Updated 3 years ago
- Shellcode Loader with Indirect Dynamic syscall Implementation , shellcode in MAC format, API resolving from PEB, Syscall calll and syscal…☆322Aug 2, 2023Updated 3 years ago
- Use hardware breakpoints to spoof the call stack for both syscalls and API calls☆204Jun 6, 2024Updated 2 years ago
- A Dropper POC with a focus on aiding in EDR evasion, NTDLL Unhooking followed by loading ntdll in-memory, which is present as shellcode (…☆178Feb 10, 2023Updated 3 years ago
- Shellcode Loader Implementing Indirect Dynamic Syscall , API Hashing, Fileless Shellcode retrieving using Winsock2☆298Jul 15, 2023Updated 3 years ago
- Patching AmsiOpenSession by forcing an error branching☆153Aug 2, 2023Updated 3 years ago
- Patch AMSI and ETW in remote process via direct syscall☆87Apr 28, 2022Updated 4 years ago
- An Aggressor Script that utilizes NtCreateUserProcess to run binaries☆32Jan 30, 2025Updated last year
- AI Agents on DigitalOcean Gradient AI Platform • AdBuild production-ready AI agents using customizable tools or access multiple LLMs through a single endpoint. Create custom knowledge bases or connect external data.
- reflectively load and execute PEs locally and remotely bypassing EDR hooks☆170Jan 4, 2024Updated 2 years ago
- A PoC to demo modifying cmdline of the child process dynamically. It might be useful against process log tracing, AV or EDR.☆39Dec 31, 2020Updated 5 years ago
- Exploring in-memory execution of .NET☆138Apr 20, 2022Updated 4 years ago
- NTDLL unhooking via Parun's Fart technique to bypass EDR userland hooks☆77Feb 15, 2023Updated 3 years ago
- different ntdll unhooking techniques : unhooking ntdll from disk, from KnownDlls, from suspended process, from remote server (fileless)☆205Aug 2, 2023Updated 3 years ago
- Loading Fileless Remote PE from URI to memory with argument passing and ETW patching and NTDLL unhooking and No New Thread technique I…☆11Jul 18, 2025Updated last year
- A CobaltStrike toolkit to write files produced by Beacon to memory instead of disk☆475Jul 6, 2024Updated 2 years ago
- All my Source Codes (Repos) for Red-Teaming & Pentesting + Blue Teaming☆229Oct 8, 2024Updated 2 years ago
- Performing Indirect Clean Syscalls☆631May 2, 2026Updated 5 months ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- Bypass Userland EDR hooks by Loading Reflective Ntdll in memory from a remote server based on Windows ReleaseID to avoid opening a handle…☆306Aug 2, 2023Updated 3 years ago
- BOF implementation of @_EthicalChaos_'s ThreadlessInject project. A novel process injection technique with no thread creation, released a…☆399Jan 9, 2024Updated 2 years ago
- Winsocket for Cobalt Strike.☆104Jul 6, 2023Updated 3 years ago
- About C# loader that copies a chunk at the time of the shellcode in memory in a suspended process, rather that all at once☆12Jul 14, 2022Updated 4 years ago
- A variation of ProcessOverwriting to execute shellcode on an executable's section☆146Dec 16, 2023Updated 2 years ago
- Source generator to add D/Invoke and indirect syscall methods to a C# project.☆194Mar 4, 2024Updated 2 years ago
- Hiding shellcode in plain sight within a large memory region. Inspired by technique used by Raspberry Robin's Roshtyak☆209Nov 12, 2025Updated 11 months ago
- This script is used to unload PsSetCreateProcessNotifyRoutineEx, PsSetCreateProcessNotifyRoutine, PsSetLoadImageNotifyRoutine and PsSetCr…☆65Feb 11, 2024Updated 2 years ago
- Jormungandr is a kernel implementation of a COFF loader, allowing kernel developers to load and execute their COFFs in the kernel.☆242Sep 26, 2023Updated 3 years ago
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- Execute unmanaged Windows executables in CobaltStrike Beacons☆722Mar 4, 2023Updated 3 years ago
- A C# Tool to gather information about email breaches☆17Dec 21, 2023Updated 2 years ago
- 横向移动三剑客 ( Lateral movement tools)☆29Nov 16, 2021Updated 4 years ago
- ☆65Nov 12, 2022Updated 3 years ago
- Create a C++ PE which loads an XTEA-crypted .NET PE shellcode in memory.☆16Sep 29, 2018Updated 8 years ago
- Start with shellcode execution using Windows APIs (high level), move on to native APIs (medium level) and finally to direct syscalls (low…☆146May 6, 2023Updated 3 years ago
- An attempt at reversing WindowsDefender☆19Oct 6, 2024Updated 2 years ago