d35ha / ProcessHide
☆63Updated last year
Related projects: ⓘ
- APC DLL Injector with NtQueueApcThread and wake up thread support☆44Updated 7 years ago
- Weaponizing Gigabyte driver for priv escalation and bypass PPL☆68Updated 5 years ago
- Process Hollowing demonstration & explanation☆31Updated 3 years ago
- Inject shellcode to process using Windows NTAPI for bypassing EDRs and Antiviruses☆40Updated 3 years ago
- ZwProcessHollowing is a x64 process hollowing project which uses direct systemcalls, dll unhooking and RC4 payload decryption☆79Updated last year
- Bypass UAC at any level by abusing the Task Scheduler and environment variables☆26Updated 3 years ago
- POC of PPID spoofing using NtCreateUserProcess with syscalls to create a suspended process and performing process injection by overwritti…☆38Updated 2 years ago
- SharpASM is a C# project that aims to automate ASM (i.e. shellcode) execution in .NET programs by exploiting code caves in RWX sections a…☆57Updated 2 years ago
- A simple PE loader.☆25Updated last year
- A simple dumper as FreshyCalls' PoC. That's what's trendy, isn't it? ¯\_(ツ)_/¯☆39Updated 3 years ago
- ☆96Updated 2 years ago
- Process Injection: APC Injection☆27Updated 3 years ago
- Unhooks Bit Defender from NTDLL and KERNELBASE using a classic technique.☆52Updated last year
- Dll injection through code page id modification in registry. Based on jonas lykk research☆116Updated last year
- ☆14Updated this week
- Herpaderply Hollowing - a PE injection technique, hybrid between Process Hollowing and Process Herpaderping☆45Updated last year
- ☆36Updated 3 years ago
- Inject unsigned DLL into Protected Process Light (PPL)☆12Updated last year
- A Study in Obfuscation: Analyzing the effect of various techniques to bypass AV engines☆41Updated last year
- ☆36Updated 2 years ago
- ☆43Updated this week
- A small commented POC for removing API hooks placed by AV/EDR.☆33Updated 4 years ago
- Collection of shellcode injection and execution techniques☆17Updated 3 years ago
- This script is used to unload PsSetCreateProcessNotifyRoutineEx, PsSetCreateProcessNotifyRoutine, PsSetLoadImageNotifyRoutine and PsSetCr…☆62Updated 7 months ago
- Clone running process with ZwCreateProcess☆58Updated 3 years ago
- Windows PE - TLS (Thread Local Storage) Injector in C/C++☆102Updated 3 years ago
- ☆15Updated 3 years ago
- Recreating and reviewing the Windows persistence methods☆39Updated 2 years ago
- Windows API Call Obfuscation☆86Updated last year
- Piece of code to detect and remove hooks in IAT☆51Updated 2 years ago