Alternatives and similar repositories for Bootkits-Rootkits-Development-Environment

Users that are interested in Bootkits-Rootkits-Development-Environment are comparing it to the libraries listed below

• Slowerzs / KeyJumper
  ☆49Updated 5 months ago
• connormcgarr / EATGuard
  Implementation of an export address table protection mitigation, like Export Address Filtering (EAF)
  ☆108Updated 2 years ago
• Reijaff / offensive_c
  ☆42Updated 2 years ago
• TheMalwareGuardian / Abyss
  Windows UEFI Bootkit
  ☆38Updated 2 weeks ago
• ViperXSecurity / lib-nosa
  lib-nosa is a minimalist C library designed to facilitate socket connections through AFD driver IOCTL operations on Windows.
  ☆114Updated 11 months ago
• bluefrostsecurity / Windows-Drive-Remapping-EoP
  ☆32Updated last year
• tyranid / windows-memory-access-traps
  A few examples of how to trap virtual memory access on Windows.
  ☆33Updated 8 months ago
• Slowerzs / CryptDecryptMemory
  ☆31Updated 8 months ago
• xforcered / Windows_MSKSSRV_LPE_CVE-2023-36802
  LPE exploit for CVE-2023-36802
  ☆22Updated last year
• jdu2600 / Etw-SyscallMonitor
  Monitors ETW for security relevant syscalls maintaining the set called by each unique process
  ☆82Updated 2 years ago
• Archie-osu / PowerHook
  Hooking KPRCB IdlePreselect function to gain execution inside PID 0.
  ☆67Updated 4 months ago
• alfarom256 / MCP-PoC
  Minifilter Callback Patching Proof-of-Concept
  ☆72Updated 2 years ago
• rad9800 / talks
  ☆58Updated 4 months ago
• maziland / StackBombing
  Next gen process injection technique
  ☆54Updated 5 years ago
• connormcgarr / Vtl1Mon
  Virtual Trust Level (VTL 1) secure call tracing
  ☆42Updated this week
• r0keb / TrashFormer
  A 64 bit executable junk code engine for polymorphic malware.
  ☆66Updated 2 months ago
• xalicex / Unhook-Import-Address-Table
  Piece of code to detect and remove hooks in IAT
  ☆64Updated 3 years ago
• matterpreter / cpuid
  A class to emulate the behavior of NtQuerySystemInformation when passed the SystemHypervisorDetailInformation information class
  ☆26Updated last year
• JanielDary / weetabix
  A C++ PoC implementation for enumerating Windows Fibers directly from memory
  ☆20Updated last year
• xaitax / ARM64-ReflectiveDLLInjection
  A Proof-of-Concept implementation of Reflective DLL Injection (RDI) specifically for Windows on ARM64. Demonstrates PEB access via the x1…
  ☆25Updated 3 months ago
• mrexodia / RiscyWorkshop
  Payload Obfuscation for Red Teams workshop materials
  ☆53Updated 2 months ago
• Dor00tkit / BamExtensionTableHook
  Proof-of-concept kernel driver that hijacks the Windows kernel extension table mechanism to preserve process notify callbacks even when a…
  ☆87Updated last month
• rbmm / TL-TASK
  ☆20Updated last week
• mannyfred / MentalTi
  Mentally ill EtwTi parser
  ☆65Updated last month
• XaFF-XaFF / Kernel-Process-Hollowing
  Windows x64 kernel mode rootkit process hollowing POC.
  ☆188Updated 2 years ago
• CaptainNox / Hypnos
  A more reliable way of resolving syscall numbers in Windows
  ☆53Updated last year
• zodiacon / Recon2023
  Recon 2023 slides and code
  ☆79Updated 2 years ago
• Internet-2-0 / Malcore-x64dbg
  This x64dbg plugin allows you to upload your sample to Malcore and view the results.
  ☆37Updated 2 years ago
• SafeBreach-Labs / MagicDot
  A set of rootkit-like abilities for unprivileged users, and vulnerabilities based on the DOT-to-NT path conversion known issue
  ☆99Updated last year
• ioncodes / SilentLoad
  "Service-less" driver loading
  ☆161Updated 9 months ago