f4rb3r1o / vmt-hookingLinks
VMT hooking is a technique where you hook one (or more) VMT(Virtual Method Table) entries with a pointer to other function. Thus, when the process calls a virtual function and fetches the function pointer to be called, it will eventually execute your code. In this example, I've create a buggy application that suffers from a data leak vulnerabili…
☆14Updated 5 years ago
Alternatives and similar repositories for vmt-hooking
Users that are interested in vmt-hooking are comparing it to the libraries listed below
Sorting:
- Signature scanner and API hooks to detect malicious process injection☆27Updated 2 years ago
- Improved VMP Idea(detect anti-anti-debug tools by bug)☆46Updated 2 years ago
- ☆26Updated last year
- A documented Windows x64 bit Usermode Injector that works via hooking IAT and hijacking its threads to execute shellcode.☆67Updated 2 years ago
- Anti-debug library based on al-khaser with ScyllaHide/TitanHide detection.☆59Updated 6 years ago
- Hypervisor-based debugger for AMD processors☆60Updated last year
- Function hooks in Windows NT Kernel☆25Updated 4 years ago
- Small project to generate fake DLLs based on an executable's import table☆23Updated 5 years ago
- x64 syscall caller in C++.☆91Updated 7 years ago
- I'm going to be dropping code from the XC3 Driver (result of reversing the driver)☆70Updated 5 years ago
- X86/X64 Hardware Breakpoint Manager☆41Updated 4 years ago
- ☆31Updated 3 years ago
- Obfuscate calls to imports by patching in stubs☆70Updated 4 years ago
- x64dbg plugin for simple spoofing of CPUID instruction behavior☆91Updated 2 years ago
- A Simple Example☆22Updated 6 years ago
- based on https://github.com/secrary/Hooking-via-InstrumentationCallback☆71Updated 5 years ago
- Type 2 Hypervisor for security research supported by AMD-V hardware assisted virtualization☆40Updated 2 years ago
- Windows Kernel API wrapper with simplified functions and enterprise driver extensions.☆29Updated last month
- x86-64 user mode emulation using Zydis☆64Updated this week
- A PoC for requesting HWIDs directly from hardware, skipping any potential hooks or OS support.☆80Updated 4 years ago
- ☆46Updated 3 years ago
- CMake template for a basic EFI application/bootkit. This library is header-only, there is no EDK2 runtime!).☆78Updated 2 years ago
- Allows for same-file KernelMode function execution using Encrypted addresses of Functions☆44Updated 10 months ago
- A simple library which provides a way to read and write the memory of other processes☆54Updated 7 years ago
- ☆38Updated 2 years ago
- Experimental disassembler for x86 binaries virtualized by VMProtect 3☆95Updated 3 years ago
- Manual PE image mapper☆65Updated 12 years ago
- Example Windows Kernel-mode Driver which enumerates running processes.☆57Updated 3 years ago
- Small memory leak PoC that is happening in IopGetDeviceInterfaces☆25Updated 4 years ago
- ☆80Updated 4 years ago