Alternatives and similar repositories for AtomicSyscall

Users that are interested in AtomicSyscall are comparing it to the libraries listed below

• NUL0x4C / KnownDllUnhook
  Replace the .txt section of the current loaded modules from \KnownDlls\ to bypass edrs
  ☆299Updated 2 years ago
• lab52io / LeakedHandlesFinder
  Leaked Windows processes handles identification tool
  ☆288Updated 3 years ago
• rad9800 / TamperingSyscalls
  ☆489Updated 2 years ago
• itm4n / PPLmedic
  Dump the memory of any PPL with a Userland exploit chain
  ☆337Updated 2 years ago
• huntandhackett / concealed_code_execution
  Tools and technical write-ups describing attacking techniques that rely on concealing code execution on Windows
  ☆216Updated 2 years ago
• thefLink / DeepSleep
  A variant of Gargoyle for x64 to hide memory artifacts using ROP only and PIC
  ☆366Updated 3 years ago
• Cracked5pider / KaynLdr
  KaynLdr is a Reflective Loader written in C/ASM
  ☆541Updated last year
• rainerzufalldererste / windows_x64_shellcode_template
  An easily modifiable shellcode template for Windows x64 written in C
  ☆257Updated 2 years ago
• deepinstinct / Dirty-Vanity
  A POC for the new injection technique, abusing windows fork API to evade EDRs. https://www.blackhat.com/eu-22/briefings/schedule/index.ht…
  ☆649Updated 2 years ago
• SolomonSklash / SleepyCrypt
  A shellcode function to encrypt a running process image when sleeping.
  ☆340Updated 3 years ago
• hasherezade / process_overwriting
  Yet another variant of Process Hollowing
  ☆405Updated this week
• zeroperil / HookDump
  Security product hook detection
  ☆319Updated 4 years ago
• rad9800 / misc
  miscellaneous scripts and programs
  ☆250Updated 6 months ago
• redteamsocietegenerale / DLLirant
  DLLirant is a tool to automatize the DLL Hijacking researches on a specified binary.
  ☆494Updated 2 years ago
• rad9800 / WTSRM
  WTSRM
  ☆214Updated 2 years ago
• LloydLabs / ntqueueapcthreadex-ntdll-gadget-injection
  This novel way of using NtQueueApcThreadEx by abusing the ApcRoutine and SystemArgument[0-3] parameters by passing a random pop r32; ret …
  ☆252Updated 2 years ago
• Cracked5pider / CoffeeLdr
  Beacon Object File Loader
  ☆287Updated last year
• DamonMohammadbagher / ETWProcessMon2
  ETWProcessMon2 is for Monitoring Process/Thread/Memory/Imageloads/TCPIP via ETW + Detection for Remote-Thread-Injection & Payload Detecti…
  ☆305Updated last year
• iilegacyyii / ThreadlessInject-BOF
  BOF implementation of @_EthicalChaos_'s ThreadlessInject project. A novel process injection technique with no thread creation, released a…
  ☆383Updated last year
• SaadAhla / UnhookingPatch
  Bypass EDR Hooks by patching NT API stub, and resolving SSNs and syscall instructions at runtime
  ☆306Updated 2 years ago
• Dec0ne / DllNotificationInjection
  A POC of a new “threadless” process injection technique that works by utilizing the concept of DLL Notification Callbacks in local and re…
  ☆451Updated last year
• kleiton0x00 / Proxy-DLL-Loads
  A proof of concept demonstrating the DLL-load proxying using undocumented Syscalls.
  ☆350Updated 5 months ago
• Wra7h / FlavorTown
  Various ways to execute shellcode
  ☆494Updated last year
• trailofbits / RpcInvestigator
  Exploring RPC interfaces on Windows
  ☆328Updated last year
• WithSecureLabs / CallStackSpoofer
  A PoC implementation for spoofing arbitrary call stacks when making sys calls (e.g. grabbing a handle via NtOpenProcess)
  ☆510Updated 3 months ago
• binderlabs / DirCreate2System
  Weaponizing to get NT SYSTEM for Privileged Directory Creation Bugs with Windows Error Reporting
  ☆358Updated 2 years ago
• mgeeky / UnhookMe
  UnhookMe is an universal Windows API resolver & unhooker addressing problem of invoking unmonitored system calls from within of your Red …
  ☆348Updated 3 years ago
• gabriellandau / PPLFault
  ☆549Updated last year
• gabriellandau / EDRSandblast-GodFault
  EDRSandblast-GodFault
  ☆266Updated last year
• kyleavery / inject-assembly
  Inject .NET assemblies into an existing process
  ☆501Updated 3 years ago