TheMalwareGuardian / Awesome-Bootkits-Rootkits-Development

Related projects ⓘ

Alternatives and complementary repositories for Awesome-Bootkits-Rootkits-Development

• jseclab / UGuardMap
  bootkit驱动映射，三环进程注入加载指定模块
  ☆11Updated last month
• eversinc33 / unKover
  PoC Anti-Rootkit/Anti-Cheat Driver.
  ☆158Updated last month
• shaygitub / windows-rootkit
  windows rootkit
  ☆51Updated 6 months ago
• TheMalwareGuardian / Abismo
  UEFI Windows Bootkit
  ☆25Updated 4 months ago
• alfarom256 / HPHardwareDiagnostics-PoC
  PoC exploit for HP Hardware Diagnostic's EtdSupp driver
  ☆50Updated last year
• jdu2600 / EtwTi-FluctuationMonitor
  Uses Threat-Intelligence ETW events to identify shellcode regions being hidden by fluctuating memory protections
  ☆95Updated last year
• SaadAhla / BlockOpenHandle
  Block any Process to open HANDLE to your process , only SYTEM is allowed to open handle to your process ,with that you can avoid remote m…
  ☆165Updated last year
• lennyRBLX / ret_addr_spoofer
  Compileable POC of namazso's x64 return address spoofer.
  ☆47Updated 4 years ago
• 0x00Alchemist / MilkBox
  Tool to dump EFI runtime drivers.
  ☆34Updated 8 months ago
• rogxo / DisableDSE
  A method to Disable DSE using .data ptr hooks
  ☆24Updated 9 months ago
• 0x00Alchemist / ResilienceKit
  Another UEFI runtime bootkit
  ☆29Updated last year
• 4l3x777 / dse_pg_bypass
  DSE & PG bypass via BYOVD attack
  ☆37Updated 7 months ago
• hid3rx / GhostWriting
  ☆22Updated last year
• 1hAck-0 / zeroimport
  ZeroImport is a lightweight and easy to use C++ library for Windows Kernel Drivers. It allows you to hide any import in your kernel drive…
  ☆45Updated last year
• android1337 / crycall
  Compile-Time Calls Obfuscator for C++14+
  ☆34Updated 11 months ago
• gabriellandau / ShadowStackWalk
  Finding Truth in the Shadows
  ☆84Updated last year
• Maldev-Academy / GhostlyHollowingViaTamperedSyscalls
  Implementing the ghostly hollowing PE injection technique using tampered syscalls.
  ☆122Updated 5 months ago
• 0mWindyBug / WFPCalloutReserach
  research revolving the windows filtering platform callout mechanism
  ☆20Updated 5 months ago
• 1027565 / InstrumentationCallbacks
  A native Windows library for intercepting kernel-to-user transitions using instrumentation callbacks
  ☆16Updated 9 months ago
• mzakocs / CVE-2021-21551-POC
  An extended proof-of-concept for the CVE-2021-21551 Dell ‘dbutil_2_3.sys’ Kernel Exploit
  ☆23Updated 3 years ago
• jdu2600 / CFG-FindHiddenShellcode
  Walks the CFG bitmap to find previously executable but currently hidden shellcode regions
  ☆100Updated last year
• 0mWindyBug / DataptrHooks
  ntoskrnl .data hooks for UM-KM communication
  ☆34Updated 5 months ago
• cbrnrd / maliketh
  🗡️ A multi-user malleable C2 framework targeting Windows. Written in C++ and Python
  ☆40Updated 8 months ago
• maziland / StackBombing
  Next gen process injection technique
  ☆42Updated 4 years ago
• brew02 / BudgetEPT
  Create stealthy, inline, EPT-like hooks using SMAP and SMEP
  ☆32Updated 3 weeks ago
• ItzPAX / wnbios_poc
  using wnbios64.sys for arbitrary r/w
  ☆10Updated 6 months ago
• WKL-Sec / LayeredSyscall
  Generating legitimate call stack frame along with indirect syscalls by abusing Vectored Exception Handling (VEH) to bypass User-Land EDR …
  ☆191Updated 3 months ago
• Flerov / EAKC-EnumAllKernelCallbacks
  Enumerate Callbacks and all Object Types
  ☆13Updated last year