ZeroMemoryEx / URootkit
user-mode Rootkit
☆98Updated 2 years ago
Related projects ⓘ
Alternatives and complementary repositories for URootkit
- Detect API Hooks☆69Updated 2 years ago
- simple Windows handle hijacker with a nod to Apxaey for inspiration☆201Updated last year
- Bypass Malware Time Delays☆97Updated 2 years ago
- Shellcodev is a tool designed to help and automate the process of shellcode creation.☆100Updated last year
- Small PoC of using a Microsoft signed executable as a lolbin.☆133Updated last year
- Block any Process to open HANDLE to your process , only SYTEM is allowed to open handle to your process ,with that you can avoid remote m…☆165Updated last year
- Windows x64 kernel mode rootkit process hollowing POC.☆182Updated last year
- ZwProcessHollowing is a x64 process hollowing project which uses direct systemcalls, dll unhooking and RC4 payload decryption☆78Updated last year
- Fud Runpe Av Evasion / All Av Bypass☆31Updated last year
- Kernel Mode Driver for Elevating Process Privileges☆130Updated last year
- Dont Call Me Back - Dynamic kernel callback resolver. Scan kernel callbacks in your system in a matter of seconds!☆224Updated 4 months ago
- GetModuleHandle (via PEB) and GetProcAddress (via EAT) like☆32Updated 2 years ago
- Create a new thread that will suspend every thread and encrypt its stack, then going to sleep , then decrypt the stacks and resume thread…☆156Updated last year
- An initial proof of concept of a bootkit based on Cr4sh's DMABackdoorBoot☆59Updated last year
- Recursive and arbitrary code execution at kernel-level without a system thread creation☆154Updated last year
- Various Process Injection Techniques☆143Updated 2 years ago
- a stage1 DLL loader with sleep obfuscation☆32Updated last year
- Deleting Shadow Copies In Pure C++☆113Updated 2 years ago
- Code used in this post https://captmeelo.com/redteam/maldev/2022/04/21/kernelcallbacktable-injection.html☆99Updated 2 years ago
- CaveCarver - PE backdooring tool which utilizes and automates code cave technique☆214Updated last year
- PoC Anti-Rootkit/Anti-Cheat Driver.☆160Updated 2 months ago
- Next gen process injection technique☆42Updated 4 years ago
- Admin to Kernel code execution using the KSecDD driver☆236Updated 7 months ago
- Implementation of an export address table protection mitigation, like Export Address Filtering (EAF)☆93Updated last year
- A Bumblebee-inspired Crypter☆80Updated last year
- A Dropper POC with a focus on aiding in EDR evasion, NTDLL Unhooking followed by loading ntdll in-memory, which is present as shellcode (…☆165Updated last year
- A proof of concept I developed to improve Gargoyle back in 2018 to achieve true memory obfuscation from position independent code☆39Updated 2 months ago
- A attempt at replicating BLACKLOTUS capabilities, whilst not acting as a direct mimic.☆85Updated last year