f4rb3r1o / vmt-hooking
VMT hooking is a technique where you hook one (or more) VMT(Virtual Method Table) entries with a pointer to other function. Thus, when the process calls a virtual function and fetches the function pointer to be called, it will eventually execute your code. In this example, I've create a buggy application that suffers from a data leak vulnerabili…
☆14Updated 4 years ago
Alternatives and similar repositories for vmt-hooking:
Users that are interested in vmt-hooking are comparing it to the libraries listed below
- Signature scanner and API hooks to detect malicious process injection☆27Updated 2 years ago
- x64dbg python3 plugin☆22Updated this week
- A Windows API hooking library !☆31Updated 2 years ago
- Learn Winapi in this Repo with examples, to understand its abstraction in reverse engineering for Windows.☆10Updated 2 years ago
- Single header library to simplify the usage of direct syscalls. x64/x86☆11Updated 2 years ago
- Analysing and defeating PatchGuard universally☆34Updated 4 years ago
- X86/X64 Hardware Breakpoint Manager☆41Updated 3 years ago
- EDR PoC WIP LLC☆11Updated last year
- Small memory leak PoC that is happening in IopGetDeviceInterfaces☆25Updated 4 years ago
- Small project to generate fake DLLs based on an executable's import table☆23Updated 4 years ago
- Fake Timestamps of Driver Certificates while keeping validity.☆17Updated 3 years ago
- Simple library to handle PE files loading, relocating, get/set data, ..., in addition to process handling☆32Updated 5 years ago
- driver interface with dll-injection capabilities☆28Updated 4 years ago
- Improved VMP Idea(detect anti-anti-debug tools by bug)☆42Updated last year
- Native API header files for the Process Hacker project (nightly).☆26Updated last week
- devirtualization vmprotect☆62Updated 2 years ago
- Driver shared section communication☆44Updated last month
- Small class to parse debug info from PEs, download their respective PDBs from the Microsoft Public Symbol Server and calculate RVAs of fu…☆44Updated 2 years ago
- Simplifies the Windows Kernel APIs by making the existing function easier to use, and extends them by creating functions that could possi…☆26Updated 3 weeks ago
- A dumper for all the imports stored within a Windows PE (portable executable).☆15Updated 3 years ago
- ☆48Updated 6 years ago
- Input-output driver☆25Updated last month
- A poc that abuses Enclave☆38Updated 2 years ago
- Remote memory library in C++17.☆31Updated 6 years ago
- combine the power of procmon and dbgview into one single application☆8Updated last year
- SoulExtraction is a windows driver library for extracting cert information in windows drivers☆22Updated 2 years ago
- manual mapping injector☆27Updated 3 years ago
- ☆21Updated 3 years ago
- x64 assembler library☆31Updated 10 months ago
- idashare is an IDA Pro plugin that allows you to quickly share the currently loaded binary and IDA database over a local HTTP server with…☆10Updated 3 weeks ago