dr4k0nia / XorStringsNET
Easy XOR string encryption for NET based binaries
☆126Updated last year
Related projects ⓘ
Alternatives and complementary repositories for XorStringsNET
- A string obfuscator for .NET apps, built to evade static string analysis.☆100Updated last year
- Packer compressing .net assemblies, (ab)using the PE format for data storage☆160Updated last year
- A .NET malware loader, using API-Hashing to evade static analysis☆203Updated last year
- Create a new thread that will suspend every thread and encrypt its stack, then going to sleep , then decrypt the stacks and resume thread…☆154Updated last year
- SharpASM is a C# project that aims to automate ASM (i.e. shellcode) execution in .NET programs by exploiting code caves in RWX sections a…☆57Updated 2 years ago
- Admin to Kernel code execution using the KSecDD driver☆237Updated 6 months ago
- Small PoC of using a Microsoft signed executable as a lolbin.☆132Updated last year
- A collection of weird ways to execute unmanaged code in .NET☆158Updated 3 years ago
- This novel way of using NtQueueApcThreadEx by abusing the ApcRoutine and SystemArgument[0-3] parameters by passing a random pop r32; ret …☆231Updated last year
- A Bumblebee-inspired Crypter☆80Updated last year
- ☆76Updated 2 months ago
- Exploitation of echo_driver.sys☆166Updated last year
- Detours implementation (x64/x86) which used only ntdll import☆88Updated 4 months ago
- Experiment on reproducing Obfuscate & Sleep☆138Updated 3 years ago
- Simple dotnet Native AOT app that uses AsmResolver to convert shellcode to PE☆64Updated last year
- A kernel vulnerability used to achieve arbitrary read-write on Windows prior to July 2022☆105Updated last year
- Files for http://blog.deniable.org/posts/windows-callbacks/☆67Updated 2 years ago
- Learning Process Injection and Hollowing techniques☆39Updated 2 years ago
- A tool for detecting manual/direct syscalls in x86 and x64 processes using Nirvana Hooks.☆104Updated 2 years ago
- ☆105Updated last year
- miscellaneous scripts and programs☆214Updated last year
- Load a dynamic library from memory by modifying the native Windows loader☆202Updated last year
- simple Windows handle hijacker with a nod to Apxaey for inspiration☆200Updated last year
- Replace the .txt section of the current loaded modules from \KnownDlls\ to bypass edrs☆287Updated 2 years ago
- Using Microsoft Warbird to automatically unpack and execute encrypted shellcode in ClipSp.sys without triggering PatchGuard☆236Updated 2 years ago
- Lenovo Diagnostics Driver EoP - Arbitrary R/W☆169Updated last year
- Use hardware breakpoints to spoof the call stack for both syscalls and API calls☆181Updated 5 months ago
- LdrLoadDll Unhooking☆120Updated 2 years ago
- A small tool I made to dump the export table of PE files. The primary use case was intended for use within DLL proxying.☆68Updated 2 years ago
- ☆63Updated 8 months ago