Hijack NotifyRoutine for a kernelmode thread
☆41Jun 4, 2022Updated 3 years ago
Alternatives and similar repositories for NotifyRoutineHijackThread
Users that are interested in NotifyRoutineHijackThread are comparing it to the libraries listed below
Sorting:
- base for testing☆186Sep 28, 2024Updated last year
- A simple way to spoof return addresses using an exception handler☆43Aug 3, 2022Updated 3 years ago
- ☆158May 21, 2024Updated last year
- Mapping your code on a 0x1000 size page☆71May 20, 2022Updated 3 years ago
- Code Integrity Violation Spotter☆17Jun 11, 2024Updated last year
- ☆40Mar 23, 2023Updated 2 years ago
- Illustrates the concept of return address spoofing, and how it is used.☆14May 13, 2020Updated 5 years ago
- Walks the Process' VAD list to grab the PTE's corresponding to a usermode virtual address, all to get the physical address☆23Nov 22, 2021Updated 4 years ago
- This project will give you an example how you can hook a kernel vtable function that cannot be directly called☆84Dec 25, 2021Updated 4 years ago
- Windows API Call Obfuscation☆112Dec 9, 2022Updated 3 years ago
- Demo to show how write ALPC Client & Server using native Ntdll.dll syscalls.☆21Jan 25, 2022Updated 4 years ago
- mouseclassservicecallback detection via hook☆52Feb 7, 2022Updated 4 years ago
- Detect removed thread from PspCidTable.☆75Mar 18, 2022Updated 3 years ago
- IAT-Obfuscation to make static analysis of executable harder.☆44Sep 6, 2021Updated 4 years ago
- ☆18Dec 4, 2020Updated 5 years ago
- ☆20May 17, 2022Updated 3 years ago
- detect hypervisor with Nmi Callback☆42Sep 25, 2022Updated 3 years ago
- Load your driver like win32k.sys☆258Aug 20, 2022Updated 3 years ago
- POC Hook of nt!HvcallCodeVa☆54May 8, 2023Updated 2 years ago
- ☆192Dec 8, 2021Updated 4 years ago
- ☆69Aug 31, 2021Updated 4 years ago
- Old way for blocking NMI interrupts☆29Sep 6, 2022Updated 3 years ago
- Cool kernel communication method.☆100Jun 27, 2021Updated 4 years ago
- Using CVE-2021-40449 to manual map kernel mode driver☆104Mar 5, 2022Updated 3 years ago
- Bypassing EasyAntiCheat.sys self-integrity by abusing call hierarchy☆83Oct 6, 2022Updated 3 years ago
- Some drivers I've written while solving exercises from Practical Reverse Engineering☆15Jan 9, 2022Updated 4 years ago
- Detect-KeAttachProcess by iterating through all processes as well as checking the context of the thread.☆121Feb 8, 2022Updated 4 years ago
- Mono process injector☆22Jan 26, 2019Updated 7 years ago
- A kernelmode driver swapping a .data pointer in the kernel to perform communication between the kernel and usermode.☆142Oct 20, 2020Updated 5 years ago
- ☆136Aug 6, 2022Updated 3 years ago
- Calling "own" MouseClassServiceCallback☆76Jul 28, 2022Updated 3 years ago
- A minimalistic way to spoof return addresses without using exceptions☆17Jul 26, 2022Updated 3 years ago
- An example code of CiGetCertPublisherName☆17Mar 24, 2022Updated 3 years ago
- ☆17Apr 21, 2022Updated 3 years ago
- eac memory sig maker☆14Jun 10, 2021Updated 4 years ago
- Anti-Analysis technique, trick the debugger by Hiding events from it.☆20Sep 6, 2021Updated 4 years ago
- clearing traces of a loaded driver☆47Jul 2, 2022Updated 3 years ago
- ☆118Aug 7, 2022Updated 3 years ago
- ☆148Jan 24, 2024Updated 2 years ago