Alternatives and similar repositories for hook-buster

Users that are interested in hook-buster are comparing it to the libraries listed below

• killvxk / awesome_code_windows_kernel

  View on GitHub
  ☆17Apr 18, 2023Updated 2 years ago
• wafinfo / SyscallLoader

  View on GitHub
  SyscallLoader
  ☆11Sep 13, 2021Updated 4 years ago
• muturikaranja / kernel-windowless-wndproc-hook

  View on GitHub
  hooks gServerHandlers xxxEventWndProc
  ☆13May 1, 2022Updated 3 years ago
• alfarom256 / UserVAtoPhysical

  View on GitHub
  Walks the Process' VAD list to grab the PTE's corresponding to a usermode virtual address, all to get the physical address
  ☆23Nov 22, 2021Updated 4 years ago
• Lima-X / XOrCryptEx

  View on GitHub
  XOrCryptEx lightweight C Utility/Algorithm
  ☆11Mar 3, 2022Updated 3 years ago
• DenuvoSoftwareSolutions / DVRT

  View on GitHub
  How Meltdown and Spectre haunt Anti-Cheat: DVRT details
  ☆22Aug 21, 2024Updated last year
• therealdreg / cgaty

  View on GitHub
  Hooking the GDT - Installing a Call Gate. POC for Rootkit Arsenal Book Second Edition (version 2022)
  ☆73Aug 11, 2023Updated 2 years ago
• jborean93 / PSDetour-Hooks

  View on GitHub
  Auditing Hooks for https://github.com/jborean93/PSDetour
  ☆13Apr 29, 2025Updated 9 months ago
• momo5502 / ept-hook-detection

  View on GitHub
  🪝 Various EPT hook detection approaches
  ☆143Jul 29, 2025Updated 6 months ago
• gmh5225 / LetMeGG

  View on GitHub
  POC about how to prevent windbg break
  ☆15Oct 3, 2022Updated 3 years ago
• timwhitez / PyC2-demo

  View on GitHub
  从入门到放弃的产物，学习过程中用python实现的一个单点c2基本功能
  ☆11Mar 11, 2020Updated 5 years ago
• Baron-von-Riedesel / ExplASM

  View on GitHub
  Windows Explorer application written in assembly
  ☆15Jun 15, 2023Updated 2 years ago
• latortuga71 / DisablePPLDriverPoc

  View on GitHub
  Disable PPL via custom driver and dump lsass
  ☆15Mar 13, 2021Updated 4 years ago
• OrShazam / ChainEngine

  View on GitHub
  automates exploits using ROP chains, using ntdll-scraper
  ☆16May 26, 2022Updated 3 years ago
• 1401199262 / UnsuccessfulDriver

  View on GitHub
  ☆17Apr 21, 2022Updated 3 years ago
• EspressoCake / NativeFunctionStaticMap

  View on GitHub
  A *very* imperfect attempt to correlate Kernel32 function calls to native API (Nt/Zw) counterparts/execution flow.
  ☆28Dec 16, 2021Updated 4 years ago
• kouzhudong / libdrv

  View on GitHub
  Static Library For Windows Drivers
  ☆41Dec 13, 2025Updated 2 months ago
• zodiacon / DbgPrint

  View on GitHub
  Debug Print viewer (user and kernel)
  ☆71Feb 7, 2024Updated 2 years ago
• klezVirus / DCKFinder

  View on GitHub
  Dangling COM Keys Finder
  ☆17Nov 16, 2021Updated 4 years ago
• Ynob2000 / pvC

  View on GitHub
  ☆15Oct 7, 2020Updated 5 years ago
• Narumiii / phantommap

  View on GitHub
  Phantom DLL Hollowing method implemented in modmap
  ☆18Jun 9, 2021Updated 4 years ago
• M0n7y5 / Shellby

  View on GitHub
  Small handy tool for crafting shellcodes by hand.
  ☆18Apr 20, 2022Updated 3 years ago
• KiFilterFiberContext / BadlionLogger

  View on GitHub
  kernel driver used to monitor the activity of BadlionAnticheat.sys by patching its IAT
  ☆33Jul 9, 2021Updated 4 years ago
• BehroozAbbassi / sdkffi

  View on GitHub
  A code parser for C-Style header files that lets you to parse function's prototypes and data types used in their parameters.
  ☆94Apr 17, 2022Updated 3 years ago
• wizardengineer / krakensvm-mg

  View on GitHub
  A simple x86_64 AMD-v hypervisor type-2 Programmed with C++, with soon to be added syscall hooks. [W.I.P]
  ☆103Aug 3, 2023Updated 2 years ago
• kkent030315 / CVE-2022-42046

  View on GitHub
  CVE-2022-42046 Proof of Concept of wfshbr64.sys local privilege escalation via DKOM
  ☆162Dec 24, 2022Updated 3 years ago
• Stuuxx / awesome-persistence

  View on GitHub
  Persistence techniques for windows.
  ☆19Jun 26, 2023Updated 2 years ago
• Gr1mmie / Coeus

  View on GitHub
  ADSI based SA tool
  ☆17Apr 9, 2022Updated 3 years ago
• LLVMParty / RemillWorkshop

  View on GitHub
  ☆64Feb 23, 2025Updated 11 months ago
• codereversing / functionhooks

  View on GitHub
  ☆21May 26, 2023Updated 2 years ago
• blaquee / APCHook

  View on GitHub
  hooking KiUserApcDispatcher
  ☆25Apr 3, 2017Updated 8 years ago
• paranoidninja / Process-Instrumentation-Syscall-Hook

  View on GitHub
  A simple program to hook the current process to identify the manual syscall executions on windows
  ☆265Nov 18, 2022Updated 3 years ago
• AdamOron / PatchGuardBypass

  View on GitHub
  Bypassing PatchGuard on modern x64 systems
  ☆265Apr 9, 2023Updated 2 years ago
• waldo-irc / MalMemDetect

  View on GitHub
  Detect strange memory regions and DLLs
  ☆185Jan 20, 2022Updated 4 years ago
• V3ded / Blog-Lab

  View on GitHub
  Source files for my posts
  ☆17Jun 20, 2023Updated 2 years ago
• serbx / KernelVtableFunctionHook

  View on GitHub
  ☆20May 17, 2022Updated 3 years ago
• cocomelonc / 2022-04-02-malware-injection-18

  View on GitHub
  Find kernel32 base and API addresses. Simple C++ implementation
  ☆24Apr 7, 2022Updated 3 years ago
• repnz / apc-research

  View on GitHub
  APC Internals Research Code
  ☆167Jun 28, 2020Updated 5 years ago
• xenoscr / manual-syscall-detect

  View on GitHub
  A tool for detecting manual/direct syscalls in x86 and x64 processes using Nirvana Hooks.
  ☆116Feb 1, 2022Updated 4 years ago