.NET process monitor that hooks CLR at the native layer, dumps reflective assemblies from memory, and checks AMSI/ETW integrity vs on disk binaries.
☆41Oct 11, 2026Updated last week
Alternatives and similar repositories for Nemesis
Users that are interested in Nemesis are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- Usermode detector that catches indirect syscalls. Traps Hell's Hall, Tartarus' Gate, RecycledGate, and VEH syscalls & Many more.☆91Jun 15, 2026Updated 4 months ago
- Cobalt Strike BOF for extracting Firefox passwords and cookies. Decrypts saved credentials using NSS, supports key3.db/key4.db, logins.js…☆42Jul 5, 2026Updated 3 months ago
- A runtime for developing large-scale and complex PIC module.☆21Sep 15, 2026Updated last month
- Nim-based encryption tool for obfuscating shellcode and payloads for evading Windows Defender.☆28Jul 14, 2026Updated 3 months ago
- macOS Container Payload Wrapper☆23Mar 13, 2026Updated 7 months ago
- Serverless GPU API endpoints on Runpod - Get Bonus Credits • AdSkip the infrastructure headaches. Auto-scaling, pay-as-you-go, no-ops approach lets you focus on innovating your application.
- example use of defining your own injection technique for explicit injection and or spawn (fork & run)☆19Jan 3, 2026Updated 9 months ago
- Windows Kernel-Mode Shellcode Development Framework (WKMSDF)☆91Aug 1, 2026Updated 2 months ago
- A Windows userland tool to enumerate and classify ALPC ports, including PPL-protected processes.☆31Aug 12, 2026Updated 2 months ago
- NailaoLoader: Hiding Execution Flow via Patching☆24Feb 27, 2025Updated last year
- AWS S3 User-Defined C2☆25Oct 6, 2026Updated 2 weeks ago
- Compile-time AES string obfuscation for C++☆108May 26, 2026Updated 4 months ago
- A tracker DLL which enables 'NTAPI->Syscall' tracking whenever it is loaded. It calls 'NtSetInformationProcess' API call with a callback …☆14Oct 21, 2024Updated 2 years ago
- Proof of concept exploit for CVE-2026-3775/CVE-2026-3780 and CVE-2026-57239 which lets you obtain NT AUTHORITY\SYSTEM rights via the Foxi…☆16Jul 27, 2026Updated 2 months ago
- ☆72Jul 12, 2026Updated 3 months ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- Find jmp gadgets for call stack spoofing.☆95Oct 1, 2025Updated last year
- RISC-V VM based shellcode loader PoC - Still WIP☆38Aug 1, 2026Updated 2 months ago
- CVE 1-day in http.sys☆39Sep 4, 2026Updated last month
- reverse engineering random malwares☆24Mar 12, 2026Updated 7 months ago
- Fully documented, updated, and comprehensive utilities for Windows 32-bit Wow64 processes☆19Aug 15, 2025Updated last year
- A concept of using a ROP chain paired with a WRMSR primitive to call kernel functions and map unsigned drivers through BYOVD (AmdTools64.…☆66Sep 21, 2026Updated last month
- Application-scoped Windows network brownouts in native C and BOF form☆22Aug 18, 2026Updated 2 months ago
- A ConfuserEx2 deobfuscator with support for anti tamper, compressor, constants, control flow, and resource recovery.☆44Jul 29, 2026Updated 2 months ago
- another PrivEsc potato...☆120Sep 5, 2026Updated last month
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- In-depth reverse engineering of a suspected LockBit affiliate dropper, documenting shellcode loading, import polymorphism, and payload de…☆16Jan 24, 2026Updated 8 months ago
- Proof of concept to detect module stomping detection by looking for modified .pdata sections.☆41Jun 11, 2026Updated 4 months ago
- ☆24Sep 12, 2026Updated last month
- Stack spoofing Detection for CET processes by comparing shadow and user stacks.☆41May 22, 2026Updated 5 months ago
- Querying And Deleting Shadow Copies Using The IOCTL_VOLSNAP_QUERY_NAMES_OF_SNAPSHOTS & IOCTL_VOLSNAP_DELETE_SNAPSHOT IOCTLs☆22Aug 7, 2025Updated last year
- Gadget scanner that finds ROP gadgets inside any Windows DLL☆47Jun 18, 2026Updated 4 months ago
- ☆37May 19, 2026Updated 5 months ago
- A POC tool for exploring dev-tunnels☆73May 5, 2026Updated 5 months ago
- A x64 Position Independent Proxy Enumerator Shellcode (PIPES)☆27Nov 14, 2025Updated 11 months ago
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- .NET CLR-Stomping☆148May 20, 2026Updated 5 months ago
- early cascade injection PoC based on Outflanks blog post, in rust☆64Nov 8, 2024Updated last year
- A Proof of Concept demonstrating CET-compliant callstack spoofing in Rust. It leverages Windows Thread Pool and Enum Callback trampolinin…☆71Jul 12, 2026Updated 3 months ago
- Anti-Debugging (Self-Debugging)☆17Sep 6, 2025Updated last year
- PE/ELF x86/x64 CFG extractor☆61Jul 2, 2026Updated 3 months ago
- Auth system with encryption and web dashboard in python☆19May 7, 2024Updated 2 years ago
- Phantom-Evasion-Loader is a standalone, pure x64 Assembly injection engine engineered to minimize the detection surface of modern EDR/XDR…☆114Aug 8, 2026Updated 2 months ago