adamhlt / Process-HollowingLinks
Process Hollowing in C++ (x86 / x64) - Process PE image replacement
☆152Updated last year
Alternatives and similar repositories for Process-Hollowing
Users that are interested in Process-Hollowing are comparing it to the libraries listed below
Sorting:
- Various Process Injection Techniques☆148Updated 3 years ago
- Reverse engineering winapi function loadlibrary.☆202Updated 2 years ago
- PoC Anti-Rootkit/Anti-Cheat Driver.☆201Updated 2 months ago
- Recursive and arbitrary code execution at kernel-level without a system thread creation☆157Updated 2 years ago
- ☆299Updated last month
- PoC capable of detecting manual syscalls from usermode.☆197Updated 7 months ago
- Custom GetProcAddress, GetModuleHandleA and some dbghelp.dll functions☆82Updated 6 years ago
- Bypassing PatchGuard on modern x64 systems☆261Updated 2 years ago
- manual map unsigned driver over signed memory☆196Updated last year
- Hooking Windows' exception dispatcher to protect process's PML4☆178Updated 5 months ago
- Inline syscalls made for MSVC supporting x64 and WOW64☆181Updated last year
- State of the art DLL injector that took 20 minutes to make☆217Updated last year
- A PoC implementation for spoofing arbitrary call stacks when making sys calls (e.g. grabbing a handle via NtOpenProcess)☆498Updated 2 months ago
- Load your driver like win32k.sys☆255Updated 2 years ago
- Dont Call Me Back - Dynamic kernel callback resolver. Scan kernel callbacks in your system in a matter of seconds!☆232Updated 11 months ago
- Create a new thread that will suspend every thread and encrypt its stack, then going to sleep , then decrypt the stacks and resume thread…☆160Updated last year
- Process Injection using Thread Name☆273Updated 2 months ago
- Simple Kernelmode DLL Injector with Manual mapping☆294Updated last year
- Simple x86/x86_64 instruction level obfuscator based on a basic SBI engine☆271Updated 2 years ago
- Kernel Security driver used to block past, current and future process injection techniques on Windows Operating System.☆153Updated 2 years ago
- load unsigned kernel-driver by patching dse in 248 lines☆124Updated last year
- x64 Windows kernel code execution via user-mode, arbitrary syscall, vulnerable IOCTLs demonstration☆330Updated 2 years ago
- Exploit MsIo vulnerable driver☆106Updated 3 years ago
- A small x64 library to load dll's into memory.☆443Updated last year
- Elevate a process to be a protected process☆150Updated 5 years ago
- Admin to Kernel code execution using the KSecDD driver☆251Updated last year
- This tool will allow you to spoof the return addresses of your functions as well as system functions.☆497Updated 2 years ago
- simple user-mode Rootkit☆104Updated 2 years ago
- Achieve arbitrary kernel read/writes/function calling in Hypervisor-Protected Code Integrity (HVCI) protected environments calling withou…☆206Updated 8 months ago
- Detects virtual machines and malware analysis environments☆130Updated 2 years ago