Comparing, discussing, and bypassing various techniques for suspending and freezing processes on Windows.
☆139Nov 10, 2021Updated 4 years ago
Alternatives and similar repositories for Suspending-Techniques
Users that are interested in Suspending-Techniques are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- VCL-based UI components for system tools that use NtUtilsLibrary☆22Oct 12, 2026Updated 2 weeks ago
- Some random system tools for Windows☆115Apr 16, 2022Updated 4 years ago
- A tool for Windows that can make any program work within file-system transactions.☆59Nov 12, 2020Updated 5 years ago
- The Definitive Guide To Process Cloning on Windows☆561Jan 3, 2024Updated 2 years ago
- PoC memory injection detection agent based on ETW, for offensive and defensive research purposes☆300Apr 10, 2021Updated 5 years ago
- Managed hosting for WordPress and PHP on Cloudways • AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- 正确解析 _HEAP_VS_***符号 ,支持在最新win11 24h2 运行,替换windbg自带的!pool命令☆17Nov 30, 2024Updated last year
- CallMon is an experimental system call monitoring tool that works on Windows 10 versions 2004+ using PsAltSystemCallHandlers☆146Sep 5, 2020Updated 6 years ago
- An advanced tool for working with access tokens and Windows security policy.☆669Oct 7, 2026Updated 3 weeks ago
- Sysmon-Like research tool for ETW☆397Nov 15, 2022Updated 3 years ago
- ☆117Aug 7, 2022Updated 4 years ago
- Delphi library for system programming on Windows using Native API☆146Updated this week
- Hijack NotifyRoutine for a kernelmode thread☆39Jun 4, 2022Updated 4 years ago
- A modified RunPE (process hollowing) technique avoiding the usage of SetThreadContext by appending a TLS section which calls the original…☆94Sep 26, 2019Updated 7 years ago
- Some research on AltSystemCallHandlers functionality in Windows 10 20H1 18999☆245Nov 6, 2019Updated 6 years ago
- Managed Database hosting by DigitalOcean • AdPostgreSQL, MySQL, MongoDB, Kafka, Valkey, and OpenSearch available. Automatically scale up storage and focus on building your apps.
- just proof of concept. hooking MmCopyMemory PG safe.☆100Nov 13, 2023Updated 2 years ago
- Simple project that demonstrates how an ETW consumer can be created just by using NTDLL☆154Feb 23, 2019Updated 7 years ago
- Tools and technical write-ups describing attacking techniques that rely on concealing code execution on Windows☆222Aug 12, 2022Updated 4 years ago
- Sysmon shenanigans☆67Oct 9, 2020Updated 6 years ago
- PoC Implementation of a fully dynamic call stack spoofer☆1,014Jul 20, 2024Updated 2 years ago
- Writing Delphi Hooks made Easy, a good starting point for those new to the subject.☆10Oct 18, 2019Updated 7 years ago
- Kernel Security driver used to block past, current and future process injection techniques on Windows Operating System.☆155Sep 11, 2022Updated 4 years ago
- a windows kernel keylogger that works☆20Feb 12, 2024Updated 2 years ago
- nmi stackwalking + module verification☆185Dec 28, 2023Updated 2 years ago
- Virtual machines for every use case on DigitalOcean • AdGet dependable uptime with 99.99% SLA, simple security tools, and predictable monthly pricing with DigitalOcean's virtual machines, called Droplets.
- Examples, slides and code from Ian Barker's Fluent UI webinars☆14Feb 8, 2021Updated 5 years ago
- Run Processes as PPL with ELAM☆185Mar 17, 2022Updated 4 years ago
- Freeze is a payload toolkit for bypassing EDRs using suspended processes, direct syscalls, and alternative execution methods☆13Sep 30, 2022Updated 4 years ago
- ☆309May 6, 2021Updated 5 years ago
- ☆507Aug 14, 2022Updated 4 years ago
- ☆164Jul 31, 2022Updated 4 years ago
- ☆13Nov 24, 2024Updated last year
- Moneta is a live usermode memory analysis tool for Windows with the capability to detect malware IOCs☆858Oct 23, 2026Updated last week
- Simple class that creates and provides access to a shared (system-wide) memory with standard stream interface (read, write, seek, ...).☆15Mar 26, 2026Updated 7 months ago
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- Reverse engineering winapi function loadlibrary.☆247Apr 17, 2023Updated 3 years ago
- APC Internals Research Code☆172Jun 28, 2020Updated 6 years ago
- This repo goes with the blog entry at blog.malicious.group entitled "Writing your own RDI / sRDI loader using C and ASM".☆90Apr 11, 2023Updated 3 years ago
- POC usermode <=> kernel communication via ALPC.☆75Jun 6, 2024Updated 2 years ago
- Process Ghosting - a PE injection technique, similar to Process Doppelgänging, but using a delete-pending file instead of a transacted fi…☆698Mar 11, 2024Updated 2 years ago
- This is the P.O.C source for hooking the system calls on Windows 10 (1903) using it's dynamic trace feature weakness☆62Sep 12, 2019Updated 7 years ago
- Thread Stack Spoofing - PoC for an advanced In-Memory evasion technique allowing to better hide injected shellcode's memory allocation fr…☆1,253Jun 17, 2022Updated 4 years ago