A curated compilation of extensive resources dedicated to bootkit and rootkit development.
☆290Aug 16, 2026Updated 2 months ago
Alternatives and similar repositories for Awesome-Bootkits-Rootkits-Development
Users that are interested in Awesome-Bootkits-Rootkits-Development are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- Windows Kernel Rootkit☆83Aug 16, 2026Updated 2 months ago
- Automated environment setup for Bootkit & Rootkit development.☆48Aug 16, 2026Updated 2 months ago
- The first publicly shared complete Windows UEFI bootkit framework for automated Ring0 rootkit deployment and APT emulation☆171Aug 16, 2026Updated 2 months ago
- Use PKfail to install UEFI Bootkits☆24Aug 16, 2026Updated 2 months ago
- Starter pack for learning how to develop Kernel-Mode rootkits: basic proof-of-concepts, development environment configuration, and step-b…☆28Jul 31, 2026Updated 3 months ago
- GPUs on demand by Runpod - Special Offer Available • AdRun AI, ML, and HPC workloads on powerful cloud GPUs—without limits or wasted spend. Deploy GPUs in under a minute and pay by the second.
- Starter pack for learning how to develop UEFI bootkits: basic proof-of-concepts, development environment configuration, and step-by-step …☆44Jul 31, 2026Updated 3 months ago
- [ARCHIVED] Early work on Benthic (Windows Kernel Rootkit).☆58Aug 15, 2025Updated last year
- [ARCHIVED] Early work on Abyss (Windows UEFI Bootkit).☆42Aug 15, 2025Updated last year
- Attacking the cleanup_module function of a kernel module☆57Jun 30, 2025Updated last year
- One Bootloader to Load Them All - Research materials, Code , Etc.☆68Aug 15, 2022Updated 4 years ago
- PIC shellcode (C/C++) development toolkit designed for malware developers.☆137Dec 23, 2025Updated 10 months ago
- A talk about finding your own path to vulnerability research and your first CVE.☆17Apr 4, 2026Updated 7 months ago
- Dynamic shellcode loader with sophisticated evasion capabilities☆344Oct 1, 2025Updated last year
- ADSIsearch is a Beacon Object File (BOF) to query Active Directory using ADDS, ADSI, and Network Management WinAPIs.☆10Feb 23, 2025Updated last year
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- Linux Sleep Obfuscation☆129Jan 7, 2024Updated 2 years ago
- Stealthy Linux Kernel Rootkit☆1,843Nov 6, 2026Updated last week
- Cuban Eight is a red team tool that packages a Windows PE payload into a .wsl file spoofing a real Linux distro installer. Double-click t…☆34Oct 16, 2026Updated 3 weeks ago
- Experimental Windows x64 Kernel Rootkit with anti-rootkit evasion features.☆617Aug 2, 2025Updated last year
- A Cobalt Strike payload generator and lateral movement aggressor script which places Beacon shellcode into a custom shellcode loader☆44Sep 25, 2024Updated 2 years ago
- Metamorphic cross-compilation of C++ & C-code to PIC, BOF & EXE.☆653Feb 2, 2026Updated 9 months ago
- BYOVD research use cases featuring vulnerable driver discovery and reverse engineering methodology. (CVE-2025-52915, CVE-2025-1055, CVE…☆1,023Aug 18, 2026Updated 2 months ago
- Windows rootkit for Intel x64 with 25+ features, demonstrating rootkit techniques compatible with all Windows 10 and Windows 11 versions.☆2,563Sep 26, 2026Updated last month
- Cobalt Strike Beacon Object File to to change the user's desktop wallpaper☆18Sep 15, 2023Updated 3 years ago
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- Hijacking valid driver services to load arbitrary (signed) drivers abusing native symbolic links and NT paths☆366Aug 11, 2024Updated 2 years ago
- A small set of Beacon Object Files (BOFs) that I developed over the time with a Magic: The Gathering theme.☆22Jul 15, 2025Updated last year
- Evasion kit for Cobalt Strike☆515Nov 2, 2026Updated last week
- Automatically scan the file system to identify Electron applications vulnerable to ASAR tampering.☆167Nov 28, 2025Updated 11 months ago
- Windows rootkit designed to work with BYOVD exploits☆227Jan 18, 2025Updated last year
- A Beacon Object File (BOF) for Havoc/CS to Bypass PPL and Dump Lsass☆179Sep 22, 2025Updated last year
- Surgical UNWIND_INFO preservation for sleep masking without call stack spoofing.☆57Mar 30, 2026Updated 7 months ago
- Dump protected process memory by using BYOVD to tamper with handle objects in the kernel.☆49Aug 5, 2025Updated last year
- Generating legitimate call stack frame along with indirect syscalls by abusing Vectored Exception Handling (VEH) to bypass User-Land EDR …☆311Jul 31, 2024Updated 2 years ago
- Serverless GPU API endpoints on Runpod - Get Bonus Credits • AdSkip the infrastructure headaches. Auto-scaling, pay-as-you-go, no-ops approach lets you focus on innovating your application.
- Dynamically convert an unmanaged EXE or DLL file to PIC shellcode by prepending a shellcode stub.☆326Apr 12, 2024Updated 2 years ago
- Intel 64/Windows low-level experiments☆119Sep 16, 2026Updated last month
- Implementing Ghostly-Hollowing using tampered syscalls for remote PE injection☆77Dec 26, 2025Updated 10 months ago
- AV/EDR evasion via direct and indirect system calls Windows NT 3.1 through Windows 11 24H2 · x64 · x86 · WoW64 · ARM64☆640Oct 24, 2026Updated 3 weeks ago
- AV/EDR Lab environment setup references to help in Malware development☆475Feb 19, 2025Updated last year
- Bring your own Unwind Data Framework☆181Mar 15, 2026Updated 8 months ago
- Two new offensive techniques using Windows Fibers: PoisonFiber (The first remote enumeration & Fiber injection capability POC tool) Phan…☆316Sep 18, 2024Updated 2 years ago
Are these results useful?