Executing Kernel Routines via Syscall Table Hijack (Kernel Code Execution)
☆86Jun 7, 2026Updated 4 months ago
Alternatives and similar repositories for win11-kernel-execution-syscall-hijack
Users that are interested in win11-kernel-execution-syscall-hijack are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- A proof of concept AMSI & ETW bypass using trampolines for hooking and modifying execution flow☆19Jun 26, 2025Updated last year
- kernel callback removal (Bypassing EDR Detections)☆232Jul 2, 2026Updated 4 months ago
- C++ Alt syscall hook in 25h2 can be load by KDU☆30Feb 18, 2026Updated 8 months ago
- BOF and research notes from hunting execution paths, covering Shell.HWEventHandlerShellExecute COM execution through the AutoPlay IHWEven…☆39Jun 20, 2026Updated 4 months ago
- Proof-of-concept kernel driver that hijacks the Windows kernel extension table mechanism to preserve process notify callbacks even when a…☆100Jul 7, 2025Updated last year
- End-to-end encrypted email - Proton Mail • AdSpecial offer: 40% Off Yearly / 80% Off First Month. All Proton services are open source and independently audited for security.
- Command channel that uses Wi-Fi Beacons as a Bidirectional C2 transport☆46Mar 28, 2026Updated 7 months ago
- Things i do because i saw it on twitter on a weekend☆56Jul 20, 2025Updated last year
- Just a nice little shellcode loader using unconventional methods to avoid using signatured APIs☆30Jul 11, 2025Updated last year
- A serie of exploits targeting eneio64.sys - Turning Physical Memory R/W into Virtual Memory R/W☆133Oct 19, 2025Updated last year
- ☆69Oct 27, 2026Updated last week
- PoC kernel to usermode injection☆143Feb 26, 2024Updated 2 years ago
- Another version of .NET loader provides capabilities of bypassing ETW and AMSI, utilizing VEH for syscalls and loading .NET assemblies☆49Jul 6, 2025Updated last year
- A C#-implemented malware that dynamically modifies its own hash upon each execution to evade detection.☆15Feb 3, 2025Updated last year
- A PoC tool for the Pass-ta-key Golden Attack, covering the extraction of the Google Password Manager Security Domain Secret from Chrome p…☆35Updated this week
- Simple, predictable pricing with DigitalOcean hosting • AdAlways know what you'll pay with monthly caps and flat pricing. Enterprise-grade infrastructure trusted by 600k+ customers.
- Proof of Concepts code for Bring Your Own Vulnerable Driver techniques☆120Aug 21, 2025Updated last year
- AIDA64DRIVER Elevation of Privilege Vulnerability☆17Oct 25, 2024Updated 2 years ago
- RunPE implementation with multiple evasive techniques (2)☆15Sep 25, 2025Updated last year
- Bypass user-land hooks by syscall tampering via the Trap Flag☆144Aug 25, 2025Updated last year
- Intel 64/Windows low-level experiments☆119Sep 16, 2026Updated last month
- Activation Context Hijacking Evasion Tool☆314Jun 17, 2026Updated 4 months ago
- The collection of the CTF challenges I designed.☆11Aug 25, 2025Updated last year
- ☆37May 19, 2026Updated 5 months ago
- APT techniques: Token theft via UpdateProcThreadAttribute. C++ implementation☆11Oct 29, 2022Updated 4 years ago
- Managed Kubernetes at scale on DigitalOcean • AdDigitalOcean Kubernetes includes the control plane, bandwidth allowance, container registry, automatic updates, and more for free.
- LPE Proof-of-Concept for Windows 11 abusing TrustedInstaller's Component Based Servicing (CBS) session COM object and junctions for arbit…☆58Updated this week
- A tool that is used to hunt vulnerabilities in x64 WDM drivers☆479Jun 18, 2026Updated 4 months ago
- demo unhooking functions in ntdll☆28Jul 15, 2025Updated last year
- A header-only, freestanding C++20 template for IR-bytecode VM loaders☆27May 10, 2026Updated 5 months ago
- Type-2 AMD-V Hypervisor☆11Jun 11, 2025Updated last year
- Windows Kernel-Mode Keylogger - Educational rootkit driver intercepting keyboard IRPs for UDP logging. Demonstrates stealth persistence, …☆16Dec 4, 2025Updated 11 months ago
- Hook syscalls from ring0 without triggering PatchGuard☆33Oct 29, 2025Updated last year
- Run unsigned kernel payloads in a signed kernel driver via wasm3. No JIT/W^x (HVCI/etc., compliant)☆155Aug 18, 2026Updated 2 months ago
- SafeHarbor revamped with Direct Syscalls using InlineWhispers3☆15Feb 16, 2026Updated 8 months ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- ☆56Oct 13, 2025Updated last year
- Locate dlls and function addresses without PEB Walk and EAT parsing☆111Nov 7, 2025Updated last year
- Commandline spoofing on Windows☆100Jul 19, 2026Updated 3 months ago
- Proof of concepts demonstrating some aspects of the Windows kernel shadow stack mitigation.☆78Jun 2, 2025Updated last year
- Robust Cobalt Strike shellcode loader with multiple advanced evasion features☆204Apr 21, 2025Updated last year
- Code execution/injection technique using DLL PEB module structure manipulation☆294Jun 4, 2025Updated last year
- Hyperspace is a multi-purpose tool for Emulating, Injecting, Dumping and Externals.☆101Jun 10, 2026Updated 4 months ago