Alternatives and similar repositories for Awesome-Bootkits-Rootkits-Development

Users that are interested in Awesome-Bootkits-Rootkits-Development are comparing it to the libraries listed below

• TheMalwareGuardian / Bentico
  [ARCHIVED] Early work on Benthic (Windows Kernel Rootkit).
  ☆56Updated 2 months ago
• 0xHossam / KernelCallbackTable-Injection-PoC
  Proof of Concept for manipulating the Kernel Callback Table in the Process Environment Block (PEB) to perform process injection and hijac…
  ☆236Updated last year
• cocomelonc / bsprishtina-2024-maldev-workshop
  BSides Prishtina 2024 Malware Development and Persistence workshop
  ☆104Updated 5 months ago
• MatheuZSecurity / Rootkit
  Collection of codes focused on Linux rootkits
  ☆183Updated 2 weeks ago
• TheMalwareGuardian / Abismo
  [ARCHIVED] Early work on Abyss (Windows UEFI Bootkit).
  ☆44Updated 2 months ago
• CyberSecurityUP / Offensive-Windows-Drivers-Development
  ☆161Updated 8 months ago
• ColeHouston / Sunder
  Windows rootkit designed to work with BYOVD exploits
  ☆211Updated 9 months ago
• klezVirus / DriverJack
  Hijacking valid driver services to load arbitrary (signed) drivers abusing native symbolic links and NT paths
  ☆351Updated last year
• floesen / KExecDD
  Admin to Kernel code execution using the KSecDD driver
  ☆258Updated last year
• cocomelonc / mdmz_book
  The result of research and investigation of malware development tricks, techniques, evasion, cryptography and linux malware
  ☆61Updated 2 months ago
• VirtualAlllocEx / Direct-Syscalls-vs-Indirect-Syscalls
  The following two code samples can be used to understand the difference between direct syscalls and indirect syscalls
  ☆214Updated last year
• ZeroMemoryEx / CVE-2025-26125
  ( 0day ) Local Privilege Escalation in IObit Malware Fighter
  ☆158Updated 7 months ago
• V-i-x-x / kernel-callback-removal
  kernel callback removal (Bypassing EDR Detections)
  ☆197Updated 7 months ago
• Maldev-Academy / LsassHijackingViaReg
  Injecting DLL into LSASS at boot
  ☆145Updated 6 months ago
• CX330Blake / Shellcode-IDE
  Shellcode IDE — makes developing and analyzing shellcode much more convenient.
  ☆93Updated last week
• rad9800 / hwbp4mw
  ☆265Updated 2 years ago
• dslee2022 / SignatureKid
  ☆373Updated 4 months ago
• lil-skelly / basilisk
  ☆14Updated 7 months ago
• ViperXSecurity / lib-nosa
  lib-nosa is a minimalist C library designed to facilitate socket connections through AFD driver IOCTL operations on Windows.
  ☆117Updated last year
• Offensive-Panda / DefenseEvasionTechniques
  This comprehensive and central repository is designed for cybersecurity enthusiasts, researchers, and professionals seeking to stay ahead…
  ☆133Updated 5 months ago
• 0xBinarySl3uth / Malware_Specimens
  This GitHub repository contains benign specimens; however, the techniques demonstrated herein could potentially be exploited for maliciou…
  ☆17Updated last year
• XaFF-XaFF / Kernel-Process-Hollowing
  Windows x64 kernel mode rootkit process hollowing POC.
  ☆189Updated 2 years ago
• ZeroMemoryEx / URootkit
  simple user-mode Rootkit
  ☆107Updated 3 years ago
• woldann / NThread
  Stealthy x64 thread manipulation library for calling functions inside target processes without creating remote threads or installing hook…
  ☆56Updated 3 weeks ago
• Kudaes / Eclipse
  Activation Context Hijack
  ☆170Updated 3 months ago
• MrAle98 / CVE-2025-21333-POC
  POC exploit for CVE-2025-21333 heap-based buffer overflow. It leverages WNF state data and I/O ring IOP_MC_BUFFER_ENTRY
  ☆222Updated 6 months ago
• xaitax / NTSleuth
  Comprehensive Windows Syscall Extraction & Analysis Framework
  ☆150Updated 2 months ago
• 0xflux / Hells-Hollow
  Hells Hollow Windows 11 Rootkit technique to Hook the SSDT via Alt Syscalls
  ☆194Updated 2 months ago
• hasherezade / thread_namecalling
  Process Injection using Thread Name
  ☆282Updated 6 months ago
• rtecCyberSec / Packer_Development
  Slides & Code snippets for a workshop held @ x33fcon 2024
  ☆272Updated last year