carlos-al / user-kernel-syscall-hook
☆82Updated 9 months ago
Alternatives and similar repositories for user-kernel-syscall-hook:
Users that are interested in user-kernel-syscall-hook are comparing it to the libraries listed below
- Finding Truth in the Shadows☆89Updated 2 years ago
- Converted phnt (Native API header files from the System Informer project) to IDA TIL, IDC (Hex-Rays).☆131Updated 7 months ago
- Report and exploit of CVE-2023-36427☆91Updated last year
- Implementation of an export address table protection mitigation, like Export Address Filtering (EAF)☆97Updated last year
- Report and exploit of CVE-2024-21305.☆35Updated last year
- Rust bindings to the System Informer's (formerly known as Process Hacker) "phnt" native Windows headers☆44Updated 2 months ago
- Demystifying PatchGuard is a comprehensive analysis of Microsoft's security feature called PatchGuard, which is designed to prevent unaut…☆117Updated last year
- This repo contains EXPs about Vulnerable Windows Driver☆37Updated 10 months ago
- Proof-of-concept game using VBS enclaves to protect itself from cheating☆39Updated 4 months ago
- Minifilter Callback Patching Proof-of-Concept☆67Updated 2 years ago
- x86-64 virtualizing obfuscator written in Rust☆74Updated last year
- LPE exploit for CVE-2023-36802☆22Updated last year
- IOCTLpus can be used to make DeviceIoControl requests with arbitrary inputs (with functionality somewhat similar to Burp Repeater).☆88Updated 3 years ago
- Walks the CFG bitmap to find previously executable but currently hidden shellcode regions☆112Updated last year
- ☆67Updated 2 years ago
- Monitors ETW for security relevant syscalls maintaining the set called by each unique process☆73Updated last year
- Load dll with undocumented functions and debug symbols☆47Updated 8 months ago
- WinDbg extension written in Rust to dump the CPU / memory state of a running VM☆115Updated 4 months ago
- A tool for detecting manual/direct syscalls in x86 and x64 processes using Nirvana Hooks.☆109Updated 3 years ago
- Uses Threat-Intelligence ETW events to identify shellcode regions being hidden by fluctuating memory protections☆118Updated last year
- PoC exploit for HP Hardware Diagnostic's EtdSupp driver☆50Updated last year
- Demonstrate calling a kernel function and handle process creation callback against HVCI☆51Updated 2 years ago
- Admin to Kernel code execution using the KSecDD driver☆244Updated 11 months ago
- A VMWare logger using built-in backdoor.☆27Updated 5 months ago
- A journal for $6,000 Riot Vanguard bounty.☆62Updated last year
- A kernel exploit leveraging NtUserHardErrorControl to elevate a thread to KernelMode and achieve arbitrary kernel R/W & more.☆26Updated 2 years ago