load arbitrary dlls, call any exported function, calls execute inside g0 as normal syscalls do from the traditional route, no syscall or windows imports, exposes many convenience functions for winapi interaction :3
☆31May 4, 2026Updated 2 months ago
Alternatives and similar repositories for go-wincall
Users that are interested in go-wincall are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- low-level windows networking library using afd.sys sockets and schannel tls. bypasses winsock, winhttp, wininet and other high-level netw…☆15Updated this week
- A cryptographic payload loader and executor designed for advanced in-memory execution techniques. This project combines strong encryption…☆27Mar 2, 2026Updated 4 months ago
- go-native-syscall is Go (+ asm) Windows syscall library that resolves, hashes, caches, and invokes direct (and indirect now) NT calls wit…☆18Aug 13, 2025Updated 11 months ago
- Anti-Debugging (Self-Debugging)☆17Sep 6, 2025Updated 10 months ago
- A BOF designed to inspect processes memory and addresses☆40Apr 19, 2026Updated 3 months ago
- Managed hosting for WordPress and PHP on Cloudways • AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- Windows Application Attack Surface Analyzer☆26Feb 22, 2024Updated 2 years ago
- ☆52Jun 12, 2026Updated last month
- Simple KDMapper driver dumper. Unlike other dumpers, this dumper dumps the PE headers of the image too.☆18May 10, 2024Updated 2 years ago
- DPAPI research and offensive tools☆17Feb 12, 2026Updated 5 months ago
- Implementation of KlezVirus' silent moonwalk approach for payloads☆18Feb 13, 2026Updated 5 months ago
- Fork of pkg/debug that adds some additional functionality.☆130Feb 14, 2026Updated 5 months ago
- ShadowStrike A Windows EDR Platform☆32Jul 7, 2026Updated 2 weeks ago
- Async BOF that monitors USB device connect/disconnect events, reports device information and performs actions on connected USB storage vo…☆56Jun 17, 2026Updated last month
- Async port/ping scanner BOF. Supports IP/port ranges, CIDR notation and hostnames.☆18Updated this week
- Managed Database hosting by DigitalOcean • AdPostgreSQL, MySQL, MongoDB, Kafka, Valkey, and OpenSearch available. Automatically scale up storage and focus on building your apps.
- COM Windows Persistence Technique☆89Apr 27, 2026Updated 2 months ago
- A tool for exploiting Kerberos tickets against system with Credential Guard enabled.☆15Sep 2, 2025Updated 10 months ago
- Run native PE or .NET executables entirely in-memory. Build the loader as an .exe or .dll—DllMain is Cobalt Strike UDRL-compatible☆272Jun 18, 2025Updated last year
- BadExclusions is a tool to identify folder custom or undocumented exclusions on AV/EDR☆21Feb 8, 2024Updated 2 years ago
- Process Hollowing in Rust with Process Executable Relocation Support for both 32 and 64 bit architecture environments.☆24Jan 6, 2025Updated last year
- Shellcode capable of bypassing EAF / IAF mitigations☆30Apr 11, 2023Updated 3 years ago
- StoneKeeper C2, an experimental EDR evasion framework for research purposes☆209Dec 25, 2024Updated last year
- MacOS Shared Library to Shellcode Loader☆73Feb 23, 2026Updated 4 months ago
- Reversed WintaPix Malware Source code | That targets countries in the Middle East and abuse KeServiceDescriptorTable(SSDT), persistence a…☆21Jul 6, 2024Updated 2 years ago
- Virtual machines for every use case on DigitalOcean • AdGet dependable uptime with 99.99% SLA, simple security tools, and predictable monthly pricing with DigitalOcean's virtual machines, called Droplets.
- A credential extraction BOF for Veeam Backup and Replication and Veeam One☆79Jul 1, 2026Updated 2 weeks ago
- A portable bridge between your C2 infrastructure and Discord, built for quick and lightweight operations.☆13Jun 3, 2025Updated last year
- Print the stack trace☆51Mar 8, 2026Updated 4 months ago
- first public in-process reflective PE loader for .NET NativeAOT binaries. maps a NativeAOT executable into the current process and execut…☆28Mar 28, 2026Updated 3 months ago
- Async BOF to automatically extract or renew Kerberos TGTs on a target system.☆134Updated this week
- Azure Blob Storage C2 Profile for Mythic☆30Jan 30, 2026Updated 5 months ago
- Fully documented, updated, and comprehensive utilities for Windows 32-bit Wow64 processes☆18Aug 15, 2025Updated 11 months ago
- Havoc C2 BOF port of the KslD.sys BYOVD technique. Credential extraction from lsass via physical memory — no OpenProcess, no auditable AP…☆144Apr 22, 2026Updated 2 months ago
- A small set of Beacon Object Files (BOFs) that I developed over the time with a Magic: The Gathering theme.☆21Jul 15, 2025Updated last year
- Managed Database hosting by DigitalOcean • AdPostgreSQL, MySQL, MongoDB, Kafka, Valkey, and OpenSearch available. Automatically scale up storage and focus on building your apps.
- Short Programs For Spreading Malware☆16Aug 11, 2021Updated 4 years ago
- Templates for developing your own listeners and agents for AdaptixC2.☆56Feb 28, 2026Updated 4 months ago
- Beacon Object File (BOF) for identifying dependent child services of a given parent.☆19Jun 20, 2025Updated last year
- Advanced OPSEC fork of Donut. Features a Custom in-memory CLR Host, Tail-Jump ETW bypasses, and zero-patch AMSI evasion for stealthy shel…☆69Jun 24, 2026Updated 3 weeks ago
- PoC on JIT Flow Redirection and .NET Reflection for Analyzing In-Memory Telemetry Interfaces (AMSI/ETW)☆16Jun 24, 2026Updated 3 weeks ago
- Opengraph-Compatible JSON Generator for BloodHound☆29Mar 30, 2026Updated 3 months ago
- From 2011: Quickly search for files in NTFS volumes parsing the Master File Table (MFT). A decent amount of how NTFS and MFT work was pai…☆28Oct 14, 2019Updated 6 years ago