Alternatives and similar repositories for iHaek

Users that are interested in iHaek are comparing it to the libraries listed below

• veryboreddd / Return-address-spoofer
  Illustrates the concept of return address spoofing, and how it is used.
  ☆13Updated 5 years ago
• xu-Wan / HypercallPageHook
  POC Hook of nt!HvcallCodeVa
  ☆52Updated 2 years ago
• nelfo / PGHooker
  PAGE_GUARD based hooking library
  ☆47Updated 2 years ago
• miketestz / ScyllaHide_VMPHeavensgateBypass
  Advanced usermode anti-anti-debugger. Forked from https://bitbucket.org/NtQuery/scyllahide
  ☆21Updated last year
• VollRagm / apphost-extract
  Extracts the files embedded inside of a .NET AppHost.
  ☆18Updated 10 months ago
• xtremegamer1 / Illicit-memory-allocation
  This driver hooks a device object for ioctl and uses mdls to allocate physical pages and manually injects an entry into a process's page …
  ☆14Updated 2 years ago
• Oliver-1-1 / EtwKeyboardDetection
  ☆30Updated 9 months ago
• 1hAck-0 / zeroimport
  ZeroImport is a lightweight and easy to use C++ library for Windows Kernel Drivers. It allows you to hide any import in your kernel drive…
  ☆47Updated 2 years ago
• Ahora57 / Unabomber
  Improved VMP Idea(detect anti-anti-debug tools by bug)
  ☆45Updated 2 years ago
• Oliver-1-1 / NMI
  ☆12Updated last year
• nulledc0de / phantom_thread
  POC kernel driver with hidden system thread
  ☆14Updated last year
• rmccrystal / modmap
  Modmap updated to work on Windows 11
  ☆28Updated 3 years ago
• weak1337 / CEDetector
  ☆46Updated 3 years ago
• SwenenzY / section-obfuscation
  PE Header (.rdata,.data,.text) obsfucation
  ☆37Updated 3 years ago
• backengineering / VDM
  Library to manipulate drivers that expose a physical memory read/write primitive.
  ☆29Updated last year
• kkent030315 / anyvtop
  x64 Windows implementation of virtual-address to physical-address translation
  ☆42Updated 4 years ago
• ByteWhite1x1 / Driver-DKOM
  An advanced DKOM for drivers with "DRIVER_OBJECT"
  ☆17Updated 2 years ago
• DErDYAST1R / SilentFunctionCaller
  Allows for same-file KernelMode function execution using Encrypted addresses of Functions
  ☆42Updated 8 months ago
• ekknod / Nmi
  Old way for blocking NMI interrupts
  ☆27Updated 2 years ago
• Peribunt / Ret-Spoofing
  A minimalistic way to spoof return addresses without using exceptions
  ☆14Updated 2 years ago
• nevioo1337 / VMHide
  Bypasses VMProtect's VMWare & VMWare Tools detection trough user-mode API hooks.
  ☆14Updated 11 months ago
• ekknod / KiSystemStartupMeme
  Custom KiSystemStartup, can be used to modificate kernel before boot.
  ☆52Updated 3 years ago
• 1401199262 / HookSwapContext
  ☆32Updated 2 years ago
• crvvdev / intraceptor
  Intraceptor intercept Windows NT API calls and redirect them to a kernel driver to bypass process/threads handle protections.
  ☆29Updated 3 years ago
• weak1337 / ricochet_deobfuscator
  ☆51Updated 3 years ago
• Zpes / pte-protect
  ☆32Updated 3 years ago
• Cesusius / Dse-Patcher
  Patches DSE by swapping both data ptrs located in SeValidateImageHeader && SeValidateImageData
  ☆20Updated last year
• backengineering / msrexec
  Elevate arbitrary MSR writes to kernel execution.
  ☆38Updated last year
• cMiraka / RWCommunication
  ☆41Updated 2 years ago
• illegal-instruction-co / ThreadIn
  Freeze target threads (external - internal ) by avoiding SuspendThread detections. Or access registers from start address.
  ☆32Updated last year