Alternatives and similar repositories for x86RetSpoof

Users that are interested in x86RetSpoof are comparing it to the libraries listed below

• waryas / KACE

  View on GitHub
  Emulate Drivers in RING3 with self context mapping or unicorn
  ☆365Aug 18, 2022Updated 3 years ago
• lennyRBLX / ret_addr_spoofer

  View on GitHub
  Compileable POC of namazso's x64 return address spoofer.
  ☆50Jun 10, 2020Updated 5 years ago
• Barracudach / CallStack-Spoofer

  View on GitHub
  This tool will allow you to spoof the return addresses of your functions as well as system functions.
  ☆541Nov 12, 2022Updated 3 years ago
• KANKOSHEV / Detect-MouseClassServiceCallback

  View on GitHub
  mouseclassservicecallback detection via hook
  ☆52Feb 7, 2022Updated 4 years ago
• Darkratos / Spoofed-Call

  View on GitHub
  A wrapper class to hide the original calling address of a function
  ☆55Aug 9, 2020Updated 5 years ago
• mike1k / perses

  View on GitHub
  X86 Mutation Engine with Portable Executable compatibility.
  ☆532May 24, 2022Updated 3 years ago
• Deputation / hygieia

  View on GitHub
  Hygieia, a vulnerable driver traces scanner written in C++ as an x64 Windows kernel driver.
  ☆150Feb 12, 2022Updated 4 years ago
• armasm / EasyAntiPatchGuard

  View on GitHub
  Easy Anti PatchGuard
  ☆223Apr 9, 2021Updated 4 years ago
• SDXT / MMInject

  View on GitHub
  Kernel DLL Injector using NX Bit Swapping and VAD hide for hiding injected DLL
  ☆220Nov 12, 2020Updated 5 years ago
• SamuelTulach / meme-rw

  View on GitHub
  Archive R/W into any protected process by changing the value of KTHREAD->PreviousMode
  ☆163Jul 31, 2022Updated 3 years ago
• KANKOSHEV / Detect-HiddenThread-via-KPRCB

  View on GitHub
  Detect removed thread from PspCidTable.
  ☆75Mar 18, 2022Updated 3 years ago
• estimated1337 / hidden_syscall

  View on GitHub
  hidden_syscall - syscaller without using syscall instruction in code
  ☆62Jan 23, 2023Updated 3 years ago
• gmh5225 / CallMeWin32kDriver

  View on GitHub
  Load your driver like win32k.sys
  ☆258Aug 20, 2022Updated 3 years ago
• 1401199262 / Hook-KdTrap

  View on GitHub
  ☆223Mar 11, 2023Updated 2 years ago
• dnz-c / proxyproc

  View on GitHub
  read / write memory from a proxy process by injecting shellcode
  ☆20Dec 23, 2025Updated last month
• Astronaut00 / DoubleDataPointer

  View on GitHub
  Allows you to communicate with the kernel mode to manipulate memory in a stealthy way to avoid kernel anticheats.
  ☆172May 8, 2022Updated 3 years ago
• lennyRBLX / manual_exception_handling

  View on GitHub
  Handling C++ & __try exceptions without the need of built-in handlers.
  ☆77Aug 28, 2021Updated 4 years ago
• POPFD / HypervisorBase

  View on GitHub
  A library for intel VT-x hypervisor functionality supporting EPT shadowing.
  ☆51Mar 11, 2021Updated 4 years ago
• ekknod / Nmi

  View on GitHub
  Old way for blocking NMI interrupts
  ☆29Sep 6, 2022Updated 3 years ago
• EBalloon / Rw-No-Attach

  View on GitHub
  ☆159May 21, 2024Updated last year
• jonomango / nohv

  View on GitHub
  Kernel driver for detecting Intel VT-x hypervisors.
  ☆192Jul 11, 2023Updated 2 years ago
• wizardengineer / krakensvm-mg

  View on GitHub
  A simple x86_64 AMD-v hypervisor type-2 Programmed with C++, with soon to be added syscall hooks. [W.I.P]
  ☆103Aug 3, 2023Updated 2 years ago
• EBalloon / MapPage

  View on GitHub
  Mapping your code on a 0x1000 size page
  ☆71May 20, 2022Updated 3 years ago
• thesecretclub / window_hijack

  View on GitHub
  Rendering on external windows via hijacking thread contexts
  ☆404Jun 28, 2020Updated 5 years ago
• ekknod / MouseClassServiceCallbackTrick

  View on GitHub
  ☆63Sep 28, 2022Updated 3 years ago
• sondernextdoor / Poseidon

  View on GitHub
  Stealthy UM <-> KM communication system without creating any system threads, permanent hooks, driver objects, section objects or device o…
  ☆376Mar 15, 2024Updated last year
• ekknod / KiSystemStartupMeme

  View on GitHub
  Custom KiSystemStartup, can be used to modificate kernel before boot.
  ☆53Apr 7, 2022Updated 3 years ago
• KANKOSHEV / Detect-KeAttachProcess

  View on GitHub
  Detect-KeAttachProcess by iterating through all processes as well as checking the context of the thread.
  ☆119Feb 8, 2022Updated 4 years ago
• ekknod / acdrv

  View on GitHub
  base for testing
  ☆186Sep 28, 2024Updated last year
• Sinclairq / hierarchy-eac

  View on GitHub
  Bypassing EasyAntiCheat.sys self-integrity by abusing call hierarchy
  ☆83Oct 6, 2022Updated 3 years ago
• boom-cr3 / NotifyRoutineHijackThread

  View on GitHub
  Hijack NotifyRoutine for a kernelmode thread
  ☆41Jun 4, 2022Updated 3 years ago
• wallds / NoVmpy

  View on GitHub
  ☆421Jan 1, 2025Updated last year
• FiYHer / InfinityHookPro

  View on GitHub
  InfinityHookPro Win7 -> Win11 latest
  ☆551Feb 7, 2023Updated 3 years ago
• SamuelTulach / mutante

  View on GitHub
  Kernel-mode Windows HWID spoofer
  ☆605Jan 22, 2024Updated 2 years ago
• btbd / smap

  View on GitHub
  DLL scatter manual mapper
  ☆810Apr 10, 2021Updated 4 years ago
• boom-cr3 / VTableKFunctionHook

  View on GitHub
  This project will give you an example how you can hook a kernel vtable function that cannot be directly called
  ☆84Dec 25, 2021Updated 4 years ago
• addrianyy / asmlib_x64

  View on GitHub
  x64 assembler library
  ☆31Jun 7, 2024Updated last year
• charliewolfe / Stealthy-Kernelmode-Injector

  View on GitHub
  Manual mapper that uses PTE manipulation, Virtual Address Descriptor (VAD) manipulation, and forceful memory allocation to hide executabl…
  ☆382Jan 29, 2022Updated 4 years ago
• crvvdev / intraceptor

  View on GitHub
  Intraceptor intercept Windows NT API calls and redirect them to a kernel driver to bypass process/threads handle protections.
  ☆32May 18, 2022Updated 3 years ago