Reference of all kernel structures, routines, and MSRs monitored by PatchGuard (KPP) on Windows.
☆21Oct 28, 2026Updated last week
Alternatives and similar repositories for WhatPatchguardProtects
Users that are interested in WhatPatchguardProtects are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- Hypervisor isolated shellcode execution environment. Maps host process memory into a guest vCPU, intercepts DLL execute faults, and proxi…☆72Updated this week
- Runtime Credential Guard deactivation via \\LSA_ISO_DISABLE_CREDENTIAL_GUARD + LSASS NT hash extraction (Win11 24H2)☆108Oct 27, 2026Updated 2 weeks ago
- MCP server exposing WinDbg/DbgEng (live user-mode, kernel, crash dumps, Time Travel Debugging) to AI agents over stdio or over HTTP with …☆20Updated this week
- A proof of concept that makes a Windows syscall look like it came from a legitimate Windows thread pool, with no trace of your own code a…☆15Jul 15, 2026Updated 3 months ago
- CVE-2026-27912 (ResetNightmare) — Linux/impacket port of Semperis Community's Invoke-ResetNightmare PoC☆18Aug 11, 2026Updated 2 months ago
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- A collection of techniques for process injection on Windows☆105Updated this week
- Simple, header-only, pattern matching and patching class + tool written in modern C++.☆25Jun 5, 2026Updated 5 months ago
- A toolkit for testing and benchmarking WPI techniques☆23Sep 2, 2026Updated 2 months ago
- Remote process injection via TP_DIRECT.Callback hijack☆41Oct 30, 2026Updated last week
- A stealthy process injection PoC combining Thread Name-Calling for payload delivery with Waiting Thread Hijacking for execution, with zer…☆141Oct 30, 2026Updated last week
- Another Injection Technique which eliminates creations of thread in remote process☆29Jul 7, 2026Updated 4 months ago
- Just another story about dragons...☆58Updated this week
- Windows Kernel-Mode Shellcode Development Framework (WKMSDF)☆90Aug 1, 2026Updated 3 months ago
- Surgical x64 VEH/VCH dumper. Walks the vectored exception handler list, extracts each handler as a standalone PE64 that IDA opens directl…☆20Jul 17, 2026Updated 3 months ago
- 1-Click AI Models by DigitalOcean Gradient • AdDeploy popular AI models on DigitalOcean Gradient GPU virtual machines with just a single click. Zero configuration with optimized deployments.
- Hooking Shadow and normal SSDT with Kaspersky Hypervisor and abusing alignment☆23Dec 5, 2020Updated 5 years ago
- Reverse engineering and live validation of the Windows Endpoint Security Platform preview☆19Sep 11, 2026Updated last month
- A Windows x64 offensive research framework that constructs fully synthetic call stacks☆76Jul 14, 2026Updated 3 months ago
- TheDarkMark is a C2 framework designed to be fast and parallel.☆25Jul 21, 2026Updated 3 months ago
- A curated list of red team tools, C2 frameworks, and adversary simulation resources for offensive security professionals.☆26Oct 9, 2026Updated last month
- ☆12Apr 5, 2024Updated 2 years ago
- DLL Forwarder/Proxy/Hijacker for x86, x64 and agnostic to name mangling.☆23Apr 1, 2025Updated last year
- Beacon Object File (BOF) to coerce machine account auth via IPP.☆101Updated this week
- UAC Bypass using CMSTP in Rust☆44Dec 6, 2024Updated last year
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- PoC for CVE-2026-58635: Windows Narrator Braille Local Privilege Escalation☆30Jul 15, 2026Updated 3 months ago
- MBA deobfuscator via Program Synthesis and Term Rewriting☆74Jul 6, 2026Updated 4 months ago
- Leveraging TPM2 TCG Logs (Measured Boot) to Detect UEFI Drivers and Pre-Boot Applications☆24Mar 28, 2025Updated last year
- ☆28Jul 14, 2026Updated 3 months ago
- Windows AppResolver LPE PoC with a filtered-admin-to-SYSTEM demonstration☆15Jul 17, 2026Updated 3 months ago
- Builds a synthetic stack using return address gadgets resolved from ntdll.dll functions. Syscall fires and returns cleanly with no user-…☆12Jun 5, 2026Updated 5 months ago
- Target files to hack☆15Apr 21, 2020Updated 6 years ago
- ☆13Feb 12, 2026Updated 8 months ago
- The swiss army knife of LSASS dumping☆14Jan 4, 2026Updated 10 months ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- Privilege Escalation via a Page Use-After-Free in Qualcomm's AI Accelerator Linux Kernel Driver☆15May 22, 2026Updated 5 months ago
- ☆13Jan 22, 2025Updated last year
- Compiler Level RISC-V Encryption Tool https://ieeexplore.ieee.org/document/9833625☆13Jan 19, 2023Updated 3 years ago
- Terminal research and study client for MITRE ATT&CK®☆22Oct 12, 2026Updated 3 weeks ago
- WinDBG tool for AI agents☆61Oct 27, 2026Updated last week
- Valve Anti-Cheat (VAC) reconstructed in C++20, bugs and all.☆56Updated this week
- P³-Shellcode Loader is a loader that implements a code injection technique which leverages the Process Parameters structure as an executi…☆247Jul 8, 2026Updated 4 months ago
Are these results useful?