Alternatives and similar repositories for Awesome-Bootkits-Rootkits-Development

Users that are interested in Awesome-Bootkits-Rootkits-Development are comparing it to the libraries listed below

• TheMalwareGuardian / Bentico
  [ARCHIVED] Early work on Benthic (Windows Kernel Rootkit).
  ☆57Updated 4 months ago
• cocomelonc / meow
  Cybersecurity research results. Simple C/C++ and Python implementations
  ☆287Updated this week
• 0xHossam / KernelCallbackTable-Injection-PoC
  Proof of Concept for manipulating the Kernel Callback Table in the Process Environment Block (PEB) to perform process injection and hijac…
  ☆265Updated last year
• MatheuZSecurity / Rootkit
  Collection of codes focused on Linux rootkits
  ☆192Updated 2 months ago
• cocomelonc / bsprishtina-2024-maldev-workshop
  BSides Prishtina 2024 Malware Development and Persistence workshop
  ☆123Updated last week
• dslee2022 / SignatureKid
  ☆391Updated 6 months ago
• cocomelonc / mdmz_book
  The result of research and investigation of malware development tricks, techniques, evasion, cryptography and linux malware
  ☆65Updated last month
• cr-0w / analysis
  🧞‍♂️ malware analysis
  ☆37Updated last year
• 0xflux / Hells-Hollow
  Hells Hollow Windows 11 Rootkit technique to Hook the SSDT via Alt Syscalls
  ☆205Updated 4 months ago
• lil-skelly / basilisk
  ☆15Updated 9 months ago
• TheMalwareGuardian / Abismo
  [ARCHIVED] Early work on Abyss (Windows UEFI Bootkit).
  ☆41Updated 4 months ago
• floesen / KExecDD
  Admin to Kernel code execution using the KSecDD driver
  ☆258Updated last year
• TheMalwareGuardian / Abyss
  Windows UEFI Bootkit
  ☆72Updated last month
• klezVirus / DriverJack
  Hijacking valid driver services to load arbitrary (signed) drivers abusing native symbolic links and NT paths
  ☆357Updated last year
• CX330Blake / Shellcode-IDE
  Shellcode IDE — makes developing and analyzing shellcode much more convenient.
  ☆108Updated last month
• hasherezade / thread_namecalling
  Process Injection using Thread Name
  ☆290Updated 8 months ago
• CyberSecurityUP / Offensive-Windows-Drivers-Development
  ☆164Updated 10 months ago
• janoglezcampos / llvm-yx-callobfuscator
  LLVM plugin to transparently apply stack spoofing and indirect syscalls to Windows x64 native calls at compile time.
  ☆316Updated last year
• ColeHouston / Sunder
  Windows rootkit designed to work with BYOVD exploits
  ☆211Updated 11 months ago
• ZeroMemoryEx / CVE-2025-26125
  ( 0day ) Local Privilege Escalation in IObit Malware Fighter
  ☆162Updated 9 months ago
• rad9800 / hwbp4mw
  ☆269Updated 2 years ago
• VirtualAlllocEx / Direct-Syscalls-vs-Indirect-Syscalls
  The following two code samples can be used to understand the difference between direct syscalls and indirect syscalls
  ☆221Updated last year
• MrAle98 / CVE-2025-21333-POC
  POC exploit for CVE-2025-21333 heap-based buffer overflow. It leverages WNF state data and I/O ring IOP_MC_BUFFER_ENTRY
  ☆224Updated 8 months ago
• hasherezade / waiting_thread_hijacking
  Waiting Thread Hijacking - injection by overwriting the return address of a waiting thread
  ☆259Updated 4 months ago
• V-i-x-x / kernel-callback-removal
  kernel callback removal (Bypassing EDR Detections)
  ☆208Updated last month
• dobin / RedEdr
  Collect Windows telemetry for Maldev
  ☆449Updated 2 months ago
• gharty03 / Conti-Ransomware
  Full source of the Conti Ransomware Including the missing Locker files from the original leak. I have fixed some of the errors intentiona…
  ☆166Updated 2 years ago
• CarlosG13 / Process-Hypnosis-Debugger-assisted-control-flow-hijack
  ☆41Updated last year
• zeze-zeze / ioctlance
  A tool that is used to hunt vulnerabilities in x64 WDM drivers
  ☆421Updated last month
• ArtemBaranov / WindowsRootkitsGuide
  ☆72Updated 11 months ago