Signal-Labs / iat_unhook_sample
(First Public?) Sample of unhooking ntdll (All Exports & IAT imports) hooks in Rust using in-memory disassembly, avoiding direct syscalls and all hooked functions (incl. hooked NtProtectVirtualMemory)
☆132Updated last month
Alternatives and similar repositories for iat_unhook_sample:
Users that are interested in iat_unhook_sample are comparing it to the libraries listed below
- An example reference design for a proposed BOF PE☆160Updated last week
- ☆135Updated last year
- Interceptor is a kernel driver focused on tampering with EDR/AV solutions in kernel space☆123Updated 2 years ago
- A Rust port of LayeredSyscall — performs indirect syscalls while generating legitimate API call stack frames by abusing VEH.☆142Updated 5 months ago
- ☆98Updated last year
- Simple POC library to execute arbitrary calls proxying them via NdrServerCall2 or similar☆130Updated 8 months ago
- ☆115Updated 2 years ago
- Malware?☆69Updated 6 months ago
- A PoC for adding NtContinue to CFG allowed list in order to make Ekko work in a CFG protected process☆99Updated 2 years ago
- Exploiting the KsecDD Windows driver through Server Silos☆66Updated 5 months ago
- bring your own vulnerable driver☆95Updated last year
- Reuse open handles to dynamically dump LSASS.☆243Updated last year
- Exploitation of process killer drivers☆199Updated last year
- Patch AMSI and ETW in remote process via direct syscall☆81Updated 2 years ago
- ☆82Updated last year
- ☆164Updated 3 years ago
- Code used in this post https://captmeelo.com/redteam/maldev/2022/04/21/kernelcallbacktable-injection.html☆122Updated 3 years ago
- The code is a pingback to the Dark Vortex blog:☆173Updated 2 years ago
- A nice process dumping tool☆81Updated 2 years ago
- Call Stack Spoofing for Rust with support #[no_std]☆83Updated this week
- Single stub direct and indirect syscalling with runtime SSN resolving for windows.☆134Updated 2 years ago
- DLL Hollowing PoC - Remote and Self shellcode injection☆79Updated 3 years ago
- Exploitation of echo_driver.sys☆169Updated last year
- Files for http://blog.deniable.org/posts/windows-callbacks/☆73Updated 3 years ago
- I have documented all of the AMSI patches that I learned till now☆71Updated 3 weeks ago
- This project is an EDRSandblast fork, adding some features and custom pieces of code.☆12Updated last year
- TypeLib persistence technique☆114Updated 6 months ago
- ☆120Updated last year
- Cobaltstrike Reflective Loader with Synthetic Stackframe☆114Updated 2 months ago
- ☆81Updated 7 months ago