Hijack NotifyRoutine for a kernelmode thread
☆41Jun 4, 2022Updated 3 years ago
Alternatives and similar repositories for NotifyRoutineHijackThread
Users that are interested in NotifyRoutineHijackThread are comparing it to the libraries listed below
Sorting:
- base for testing☆187Sep 28, 2024Updated last year
- A simple way to spoof return addresses using an exception handler☆44Aug 3, 2022Updated 3 years ago
- Mapping your code on a 0x1000 size page☆71May 20, 2022Updated 3 years ago
- Illustrates the concept of return address spoofing, and how it is used.☆14May 13, 2020Updated 5 years ago
- ☆158May 21, 2024Updated last year
- ☆41Mar 23, 2023Updated 2 years ago
- This project will give you an example how you can hook a kernel vtable function that cannot be directly called☆84Dec 25, 2021Updated 4 years ago
- An example code of CiGetCertPublisherName☆16Mar 24, 2022Updated 3 years ago
- ☆20May 17, 2022Updated 3 years ago
- Code Integrity Violation Spotter☆17Jun 11, 2024Updated last year
- Old way for blocking NMI interrupts☆29Sep 6, 2022Updated 3 years ago
- mouseclassservicecallback detection via hook☆52Feb 7, 2022Updated 4 years ago
- Windows API Call Obfuscation☆113Dec 9, 2022Updated 3 years ago
- POC Hook of nt!HvcallCodeVa☆54May 8, 2023Updated 2 years ago
- ☆18Dec 4, 2020Updated 5 years ago
- Detect removed thread from PspCidTable.☆75Mar 18, 2022Updated 4 years ago
- Mono process injector☆22Jan 26, 2019Updated 7 years ago
- ☆16Jun 20, 2022Updated 3 years ago
- Load your driver like win32k.sys☆258Aug 20, 2022Updated 3 years ago
- ☆192Dec 8, 2021Updated 4 years ago
- Walks the Process' VAD list to grab the PTE's corresponding to a usermode virtual address, all to get the physical address☆23Nov 22, 2021Updated 4 years ago
- Demo to show how write ALPC Client & Server using native Ntdll.dll syscalls.☆21Jan 25, 2022Updated 4 years ago
- BattlEye kernel module bypass☆177Oct 1, 2022Updated 3 years ago
- Patches DSE by swapping both data ptrs located in SeValidateImageHeader && SeValidateImageData☆24Feb 9, 2024Updated 2 years ago
- 一个界面基于IMGUI的ARK，目前R3实现☆13Nov 1, 2023Updated 2 years ago
- Some drivers I've written while solving exercises from Practical Reverse Engineering☆15Jan 9, 2022Updated 4 years ago
- State of the art DLL injector that took 20 minutes to make☆227Aug 16, 2023Updated 2 years ago
- Calling "own" MouseClassServiceCallback☆76Jul 28, 2022Updated 3 years ago
- detect hypervisor with Nmi Callback☆42Sep 25, 2022Updated 3 years ago
- ☆17Apr 21, 2022Updated 3 years ago
- ☆118Aug 7, 2022Updated 3 years ago
- Bypassing EasyAntiCheat.sys self-integrity by abusing call hierarchy☆83Oct 6, 2022Updated 3 years ago
- ☆136Aug 6, 2022Updated 3 years ago
- Using CVE-2021-40449 to manual map kernel mode driver☆103Mar 5, 2022Updated 4 years ago
- Read Memory without ReadProcessMemory for Current Process☆92Feb 13, 2022Updated 4 years ago
- ☆147Jan 24, 2024Updated 2 years ago
- Scans all modules in target process for jmp/int3 hooks dissassembles then and follows jmps to destination.☆82Nov 5, 2023Updated 2 years ago
- A minimalistic way to spoof return addresses without using exceptions☆18Jul 26, 2022Updated 3 years ago
- undetected eac mapper☆170May 3, 2022Updated 3 years ago