aaaddress1 / ntkrnlProtectScan
One Click Tool to Scan All the Enabled Protection of current Windows NT Kernel
☆43Updated 11 months ago
Related projects: ⓘ
- Windows AppLocker Driver (appid.sys) LPE☆30Updated last month
- 🗡️ A multi-user malleable C2 framework targeting Windows. Written in C++ and Python☆36Updated 6 months ago
- ☆23Updated 10 months ago
- Research into removing strings & API call references at compile-time (Anti-Analysis)☆22Updated 3 months ago
- ☆26Updated 2 months ago
- ☆23Updated 4 months ago
- Windows 10 DLL Injector via Driver utilizing VAD and hiding the loaded driver☆51Updated 11 months ago
- Simple ETW unhook PoC. Overwrites NtTraceEvent opcode to disable ETW at Nt-function level.☆41Updated 6 months ago
- ☆55Updated this week
- Simple PoC to locate hooked functions by EDR in ntdll.dll☆31Updated last year
- Your NTDLL vaccine from modern direct syscall methods.☆35Updated 2 years ago
- An issue in AVG AVG Anti-Spyware v.7.5 allows an attacker to execute arbitrary code via a crafted script to the guard.exe component☆11Updated last year
- Enumerate Callbacks and all Object Types☆13Updated last year
- Set the process mitigation policy for loading only Microsoft Modules , and block any userland 3rd party modules☆41Updated last year
- Persistence via Shell Extensions☆60Updated last year
- Reimplementation of the KExecDD DSE bypass technique.☆42Updated last week
- A class to emulate the behavior of NtQuerySystemInformation when passed the SystemHypervisorDetailInformation information class☆24Updated last year
- API Hammering with C++20☆34Updated 2 years ago
- A POC of a new “threadless” process injection technique that works by utilizing the concept of DLL Notification Callbacks in local and re…☆18Updated last year
- Research of modifying exported function names at runtime (C/C++, Windows)☆16Updated 3 months ago
- Various methods of executing shellcode☆67Updated last year
- Classic Process Injection with Memory Evasion Techniques implemantation☆64Updated 10 months ago
- ☆33Updated last year
- This program is used to perform reflective DLL Injection to a remote process specified by the user.☆61Updated last year
- yet another sleep encryption thing. also used the default github repo name for this one.☆69Updated last year
- A reimplementation of Cobalt Strike's Beacon Object File (BOF) Loader☆34Updated 9 months ago
- Indirect Syscall implementation to bypass userland NTAPIs hooking.☆52Updated last month
- the Open Source and Pure C++ Packer for eXecutables☆18Updated last year
- PoC exploit for HP Hardware Diagnostic's EtdSupp driver☆50Updated last year
- Process Ghosting is a technique in which a process is created from a delete pending file. This means the created process is not backed by…☆14Updated 4 months ago