Unprotect is a collaborative platform dedicated to uncovering and documenting malware evasion techniques. We invite you to join us in this exciting journey and add your expertise to our collective efforts. By contributing, you’ll help strengthen the project and push the boundaries of what we can achieve together.
☆209Mar 30, 2026Updated 7 months ago
Alternatives and similar repositories for Unprotect_Submission
Users that are interested in Unprotect_Submission are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- Malware Muncher is a proof-of-concept Python script that utilizes the Frida framework for binary instrumentation and API hooking, enablin…☆46Feb 24, 2023Updated 3 years ago
- I have documented all of the AMSI patches that I learned till now☆72Nov 4, 2025Updated 11 months ago
- yet another sleep encryption thing. also used the default github repo name for this one.☆67May 11, 2023Updated 3 years ago
- Experimental Windows x64 Kernel Rootkit with anti-rootkit evasion features.☆611Aug 2, 2025Updated last year
- Threadless Process Injection using remote function hooking.☆823Sep 4, 2024Updated 2 years ago
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- ☆33Dec 21, 2023Updated 2 years ago
- The code is a pingback to the Dark Vortex blog:☆191Jan 26, 2023Updated 3 years ago
- Execute a payload at each right click on a file/folder in the explorer menu for persistence☆172Mar 15, 2023Updated 3 years ago
- Web based user interface for OpenRelik☆13Jun 21, 2026Updated 4 months ago
- CaveCarver - PE backdooring tool which utilizes and automates code cave technique☆230Apr 17, 2023Updated 3 years ago
- This repo contains : simple shellcode Loader , Encoders (base64 - custom - UUID - IPv4 - MAC), Encryptors (AES), Fileless Loader (Winhttp…☆442Aug 2, 2023Updated 3 years ago
- HWSyscalls is a new method to execute indirect syscalls using HWBP, HalosGate and a synthetic trampoline on kernel32 with HWBP.☆734Jul 19, 2023Updated 3 years ago
- Shellcodev is a tool designed to help and automate the process of shellcode creation.☆114Oct 11, 2023Updated 3 years ago
- A PoC implementation for an evasion technique to terminate the current thread and restore it before resuming execution, while implementin…☆542Aug 1, 2022Updated 4 years ago
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- A C implementation of the Sektor7 "A Thief" Windows privesc technique.☆67Mar 25, 2022Updated 4 years ago
- Start with shellcode execution using Windows APIs (high level), move on to native APIs (medium level) and finally to direct syscalls (low…☆146May 6, 2023Updated 3 years ago
- Now You See Me, Now You Don't☆1,074May 22, 2026Updated 5 months ago
- ☆106May 15, 2023Updated 3 years ago
- ☆117Aug 7, 2022Updated 4 years ago
- ☆115Oct 10, 2022Updated 4 years ago
- A work in progress BOF/COFF loader in Rust☆51Mar 22, 2023Updated 3 years ago
- ☆91Jul 18, 2023Updated 3 years ago
- Splitting and executing shellcode across multiple pages☆102Jun 8, 2023Updated 3 years ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- A Practical example of ELAM (Early Launch Anti-Malware)☆35Nov 12, 2021Updated 4 years ago
- Another approach of Threadless injection discovered by @_EthicalChaos_ in c that loads a module into the target process and stomps it, an…☆189Aug 2, 2023Updated 3 years ago
- A PoC for adding NtContinue to CFG allowed list in order to make Ekko work in a CFG protected process☆113Aug 29, 2022Updated 4 years ago
- This script is used to unload PsSetCreateProcessNotifyRoutineEx, PsSetCreateProcessNotifyRoutine, PsSetLoadImageNotifyRoutine and PsSetCr…☆66Feb 11, 2024Updated 2 years ago
- powershell script i wrote that can suspend an arbitrary process (with limits)☆22Mar 26, 2023Updated 3 years ago
- Windows Kernel Programming Experiments☆84Sep 18, 2022Updated 4 years ago
- A PoC implementation for spoofing arbitrary call stacks when making sys calls (e.g. grabbing a handle via NtOpenProcess)☆602Apr 8, 2025Updated last year
- Reverse Engineering and Debugging Malware☆31Feb 27, 2023Updated 3 years ago
- C or BOF file to extract WebKit master key to decrypt user cookie☆211Apr 29, 2024Updated 2 years ago
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- Living Off The Land Drivers☆1,836Updated this week
- This project is an implant framework designed for long term persistent access to Windows machines.☆107Sep 22, 2023Updated 3 years ago
- Moneta is a live usermode memory analysis tool for Windows with the capability to detect malware IOCs☆858Oct 23, 2026Updated last week
- Thread Stack Spoofing - PoC for an advanced In-Memory evasion technique allowing to better hide injected shellcode's memory allocation fr…☆1,253Jun 17, 2022Updated 4 years ago
- malleable profile generator GUI for Havoc☆54Apr 28, 2023Updated 3 years ago
- OpenRelik worker to interact with a Timesketch server☆10Feb 14, 2026Updated 8 months ago
- For when DLLMain is the only way☆439Oct 29, 2024Updated 2 years ago