diversenok / Suspending-Techniques
Comparing, discussing, and bypassing various techniques for suspending and freezing processes on Windows.
☆114Updated 3 years ago
Related projects ⓘ
Alternatives and complementary repositories for Suspending-Techniques
- Using Microsoft Warbird to automatically unpack and execute encrypted shellcode in ClipSp.sys without triggering PatchGuard☆239Updated 2 years ago
- APC Internals Research Code☆159Updated 4 years ago
- Global user-mode hooking framework, based on AppInit_DLLs. The goal is to allow you to rapidly develop hooks to inject in an arbitrary pr…☆161Updated 2 years ago
- ☆65Updated last year
- CallMon is an experimental system call monitoring tool that works on Windows 10 versions 2004+ using PsAltSystemCallHandlers☆129Updated 4 years ago
- Reimplement CreateProcessInternalW via Windows 10 20H1+/Windows 11 Base on NtCreateUserProcess-Post☆47Updated 2 months ago
- File system minifilter driver for Windows to block symbolic link attacks.☆51Updated 3 years ago
- Converted phnt (Native API header files from the System Informer project) to IDA TIL, IDC (Hex-Rays).☆115Updated 3 months ago
- x64 Windows kernel code execution via user-mode, arbitrary syscall, vulnerable IOCTLs demonstration☆226Updated 2 years ago
- Resolve DOS MZ executable symbols at runtime☆93Updated 3 years ago
- Three Tiny Examples of Directly Using Vista's NtCreateUserProcess☆85Updated 9 years ago
- Single header version of System Informer's phnt library.☆186Updated last week
- API Set resolver for Windows☆118Updated 2 months ago
- An example of a client and server using Windows' ALPC functions to send and receive data.☆89Updated 4 years ago
- A list of excellent resources for anyone to deepen their understanding with regards to Windows Kernel Exploitation and general low level …☆123Updated 2 years ago
- PE Viewer☆152Updated 3 weeks ago
- Simple windows API logger☆98Updated 5 years ago
- Hook all callbacks which are registered with LdrRegisterDllNotification☆83Updated last year
- A quick-and-dirty anti-hook library proof of concept.☆101Updated 6 years ago
- Documenting system information classes and their uses☆50Updated 3 years ago
- Advanced driver monitoring utility.☆201Updated 2 years ago
- A tool for detecting manual/direct syscalls in x86 and x64 processes using Nirvana Hooks.☆105Updated 2 years ago
- Some research on AltSystemCallHandlers functionality in Windows 10 20H1 18999☆206Updated 5 years ago
- Browse Page Tables on Windows (Page Table Viewer)☆184Updated 2 years ago
- Simple project that demonstrates how an ETW consumer can be created just by using NTDLL☆136Updated 5 years ago
- x64 Windows PatchGuard bypass, register process-creation callbacks from unsigned code☆197Updated 3 years ago
- C++ library for parsing and manipulating PE files statically and dynamically.☆87Updated last year
- Small tool to convert beteween the PE alignments (raw and virtual).☆81Updated last year
- A collection of tools, source code, and papers researching Windows' implementation of CET.☆74Updated 4 years ago
- Reverse engineering winapi function loadlibrary.☆70Updated last year