Alternatives and similar repositories for ClrAmsiScanPatcher:

Users that are interested in ClrAmsiScanPatcher are comparing it to the libraries listed below

• EvilBytecode / Evilbytecode-Gate
  Evilbytecode-Gate resolves Windows System Service Numbers (SSNs) using two methods: analyzing the Guard CF Table in ntdll.dll and parsing…
  ☆20Updated 2 months ago
• C5Hackr / c_syscalls
  https://github.com/janoglezcampos/c_syscalls with the ASM rewritten by myself for Visual Studio's Compiler.
  ☆31Updated 10 months ago
• s4dbrd / ETWReader
  Read ETW Provider events. Inspired by ETWExplorer by Pavel Yosifovich
  ☆16Updated 9 months ago
• EvilBytecode / Amsi-Patch-Updated-2025
  How to bypass AMSI (Antimalware Scan Interface) in PowerShell/C++ by dynamically patching the AmsiScanBuffer function.
  ☆13Updated last month
• 0xv1n / proc-suspend
  powershell script i wrote that can suspend an arbitrary process (with limits)
  ☆20Updated 2 years ago
• ricardojoserf / SharpObfuscate
  Obfuscate payloads using IPv4, IPv6, MAC or UUID strings
  ☆15Updated last year
• GetRektBoy724 / SyscallShuffler
  Your NTDLL vaccine from modern direct syscall methods.
  ☆35Updated 3 years ago
• Fadi002 / MalwareInvestigation
  reverse engineering random malwares
  ☆21Updated 2 months ago
• rbmm / Services
  ☆18Updated 3 months ago
• Offensive-Panda / PEB_WALK_AND_API_OBFUSCATION_INJECTION
  This exploit use PEB walk technique to resolve API calls dynamically, obfuscate all API calls to perform process injection.
  ☆17Updated 8 months ago
• ricardojoserf / NativeNtdllRemap
  Remap ntdll.dll using only NTAPI functions with a suspended process
  ☆21Updated last week
• DebugPrivilege / WindowsAP1
  Code samples that serve as references for Windows API functions
  ☆30Updated 10 months ago
• TimMisiak / RunWithDll
  A utility that can be used to launch an executable with a DLL injected
  ☆18Updated last year
• 0x11DFE / file-unpumper
  Tool that can be used to trim useless things from a PE file such as the things a file pumper would add.
  ☆26Updated 3 weeks ago
• lleon1435 / Kernel_VADInjector
  Windows 10 DLL Injector via Driver utilizing VAD and hiding the loaded driver
  ☆50Updated last year
• secana / CertDump
  Dump certificates from PE files in different formats
  ☆38Updated last year
• jsecurity101 / MSFT_DriverBlockList
  Repository of Microsoft Driver Block Lists based off of OS-builds
  ☆39Updated last year
• outflanknl / unmanaged-dotnet-patch
  Modify managed functions from unmanaged code
  ☆51Updated last year
• matterpreter / cpuid
  A class to emulate the behavior of NtQuerySystemInformation when passed the SystemHypervisorDetailInformation information class
  ☆26Updated last year
• Cracked5pider / unguard-eat
  havoc kaine plugin to mitigate PAGE_GUARD protected image headers using JOP gadgets
  ☆27Updated 8 months ago
• Dump-GUY / sc2pe
  Simple dotnet Native AOT app that uses AsmResolver to convert shellcode to PE
  ☆65Updated last year
• AlSch092 / HideStaticReferences
  Research into removing strings & API call references at compile-time (Anti-Analysis)
  ☆25Updated 10 months ago
• HackingThings / SuperSneakyExec
  Loading and executing shellcode in C# without PInvoke.
  ☆20Updated 3 years ago
• amroes / FlexSheller
  ☆11Updated 2 months ago
• Sh3lldon / WinPWN
  This repo for Windows x32-x64 Kernel/Driver/User Mode Exploitation writeups and exploits
  ☆23Updated 11 months ago
• frkngksl / UnlinkDLL
  DLL Unlinking from InLoadOrderModuleList, InMemoryOrderModuleList, InInitializationOrderModuleList, and LdrpHashTable
  ☆57Updated last year
• MaorSabag / HollowMask
  Just another Process Injection using Process Hollowing technique.
  ☆17Updated last year
• CyberSecurityUP / SyscallHookDetector
  ☆17Updated 6 months ago
• thefLink / Hunt-Weird-ImageLoads
  Small tool to play with IOCs caused by Imageload events
  ☆42Updated last year
• Idov31 / talks-and-publications
  Released presentations of my talks + code that used during these talks
  ☆13Updated 7 months ago