Alternatives and similar repositories for user-kernel-syscall-hook

Users that are interested in user-kernel-syscall-hook are comparing it to the libraries listed below

• djolertrk / kovid-obfuscation-passes
  A set of LLVM and GCC based plugins that perform code obfuscation.
  ☆126Updated 3 weeks ago
• gabriellandau / ShadowStackWalk
  Finding Truth in the Shadows
  ☆110Updated 2 years ago
• cursey / x64-virtualizer-rs
  x86-64 virtualizing obfuscator written in Rust
  ☆79Updated last year
• Dump-GUY / IDA_PHNT_TYPES
  Converted phnt (Native API header files from the System Informer project) to IDA TIL, IDC (Hex-Rays).
  ☆146Updated 10 months ago
• codedefender-io / sigbreaker
  All LLVM binaries scrambled with SigBreaker and used to test against llvm-lit
  ☆21Updated 2 months ago
• AmitMoshel1 / PatchGuardEncryptorDriver
  An improved version of Patch Guard that I implemented, that includes integrity checks and other protection mechanisms I added.
  ☆70Updated 3 months ago
• jdu2600 / CFG-FindHiddenShellcode
  Walks the CFG bitmap to find previously executable but currently hidden shellcode regions
  ☆118Updated 2 years ago
• Nordgaren / stealth-win
  ☆47Updated last year
• tandasat / CVE-2024-21305
  Report and exploit of CVE-2024-21305.
  ☆36Updated last year
• android1337 / brkida
  C++ macro for x64 programs that breaks ida hex-rays decompiler tool.
  ☆122Updated last year
• connormcgarr / EATGuard
  Implementation of an export address table protection mitigation, like Export Address Filtering (EAF)
  ☆105Updated 2 years ago
• brew02 / BudgetEPT
  Create stealthy, inline, EPT-like hooks using SMAP and SMEP
  ☆55Updated 8 months ago
• worawit / malk
  Demonstrate calling a kernel function and handle process creation callback against HVCI
  ☆64Updated 2 years ago
• DriverHunter / Win-Driver-EXP
  This repo contains EXPs about Vulnerable Windows Driver
  ☆46Updated last year
• Idov31 / NovaHypervisor
  NovaHypervisor is a defensive x64 Intel host based hypervisor. The goal of this project is to protect against kernel based attacks (eithe…
  ☆137Updated this week
• 0vercl0k / snapshot
  WinDbg extension written in Rust to dump the CPU / memory state of a running VM
  ☆117Updated last month
• FunnyWhaleDev / AlterLoadDll
  Load dll with undocumented functions and debug symbols
  ☆47Updated 11 months ago
• rbmm / NtDetours
  Detours implementation (x64/x86) which used only ntdll import
  ☆90Updated last year
• m417z / LdrDllNotificationHook
  Hook all callbacks which are registered with LdrRegisterDllNotification
  ☆87Updated 3 months ago
• SamuelTulach / SecureGame
  Proof-of-concept game using VBS enclaves to protect itself from cheating
  ☆42Updated 8 months ago
• xforcered / Windows_MSKSSRV_LPE_CVE-2023-36802
  LPE exploit for CVE-2023-36802
  ☆22Updated last year
• D4stiny / ExceptionOrientedProgramming
  Abusing exceptions for code execution.
  ☆111Updated 2 years ago
• zer0condition / Demystifying-PatchGuard
  Demystifying PatchGuard is a comprehensive analysis of Microsoft's security feature called PatchGuard, which is designed to prevent unaut…
  ☆124Updated 2 years ago
• 3intermute / ramiel
  uefi diskless persistence technique + OVMF secureboot bypass
  ☆81Updated last year
• 4l3x777 / dse_pg_bypass
  DSE & PG bypass via BYOVD attack
  ☆52Updated last year
• shaygitub / windows-rootkit
  windows rootkit
  ☆60Updated last year
• xenoscr / manual-syscall-detect
  A tool for detecting manual/direct syscalls in x86 and x64 processes using Nirvana Hooks.
  ☆113Updated 3 years ago
• jdu2600 / Etw-SyscallMonitor
  Monitors ETW for security relevant syscalls maintaining the set called by each unique process
  ☆80Updated 2 years ago
• rce-3 / xenith
  Research-focused hypervisor offering advanced tools for debugging, virtual machine introspection, and automation.
  ☆20Updated 3 weeks ago
• tandasat / CVE-2023-36427
  Report and exploit of CVE-2023-36427
  ☆90Updated last year