ch3rn0byl / Gremlins

Related projects ⓘ

Alternatives and complementary repositories for Gremlins

• ch3rn0byl / CVE-2021-21551
  ☆25Updated 3 years ago
• 0xMegaByte / COM-Explained
  ☆27Updated 2 years ago
• ch3rn0byl / WinDbg-Extensions
  ☆17Updated 3 years ago
• jsecurity101 / MSFT_DriverBlockList
  Repository of Microsoft Driver Block Lists based off of OS-builds
  ☆38Updated 6 months ago
• pr0tean / TelemetrySourcerer-patched
  Tiny driver patch to allow kernel callbacks to work on Win10 21h1
  ☆31Updated 2 years ago
• worawit / malk
  Demonstrate calling a kernel function and handle process creation callback against HVCI
  ☆48Updated last year
• benheise / ANGRYORCHARD
  A kernel exploit leveraging NtUserHardErrorControl to elevate a thread to KernelMode and achieve arbitrary kernel R/W & more.
  ☆28Updated 2 years ago
• zodiacon / VerifierDLL
  Example of building an application verifer DLL
  ☆45Updated 5 months ago
• jsacco / PPL_Bypass
  ☆12Updated 2 years ago
• alfarom256 / MCP-PoC
  Minifilter Callback Patching Proof-of-Concept
  ☆61Updated 2 years ago
• RobinFassinaMoschiniForks / TransitionalPeriod
  Former Multi - Ring to Kernel To UserMode Transitional Shellcode For Remote Kernel Exploits
  ☆28Updated 2 years ago
• 0mWindyBug / MinifilterHook
  silence file system monitoring components by hooking their minifilters
  ☆51Updated 9 months ago
• ByteWhite1x1 / PatchGuardResearch
  Bypassing kernel patch protection runtime
  ☆19Updated last year
• 0mWindyBug / WFPCalloutReserach
  research revolving the windows filtering platform callout mechanism
  ☆20Updated 5 months ago
• lennyRBLX / ret_addr_spoofer
  Compileable POC of namazso's x64 return address spoofer.
  ☆47Updated 4 years ago
• mobdk / CloneProcess
  Clone running process with ZwCreateProcess
  ☆58Updated 4 years ago
• rad9800 / VehApiResolve
  ☆98Updated 2 years ago
• alfarom256 / HPHardwareDiagnostics-PoC
  PoC exploit for HP Hardware Diagnostic's EtdSupp driver
  ☆50Updated last year
• connormcgarr / EATGuard
  Implementation of an export address table protection mitigation, like Export Address Filtering (EAF)
  ☆92Updated last year
• gabriellandau / ShadowStackWalk
  Finding Truth in the Shadows
  ☆84Updated last year
• Flawww / NtSyscaller
  Manually perform syscalls without going through any external API or DLL.
  ☆16Updated last year
• alfarom256 / drivers_and_shit
  ☆57Updated 2 years ago
• 1hAck-0 / zeroimport
  ZeroImport is a lightweight and easy to use C++ library for Windows Kernel Drivers. It allows you to hide any import in your kernel drive…
  ☆45Updated last year
• rbmm / NtDetours
  Detours implementation (x64/x86) which used only ntdll import
  ☆88Updated 4 months ago
• rbmm / TPM
  Easy encrypt/decrypt data with TPM
  ☆24Updated 8 months ago
• rbmm / RtlClone
  ☆27Updated 3 months ago
• hid3rx / GhostWriting
  ☆22Updated last year
• veil-ivy / kapc_injector
  kernel to user mode APC injector
  ☆43Updated 2 years ago
• waleedassar / ALPC_CLIENT_SERVER
  Demo to show how write ALPC Client & Server using native Ntdll.dll syscalls.
  ☆20Updated 2 years ago
• lem0nSec / Dsebler
  Reimplementation of the KExecDD DSE bypass technique.
  ☆42Updated 2 months ago