Alternatives and similar repositories for Vx-Engines:

Users that are interested in Vx-Engines are comparing it to the libraries listed below

• DanielAvinoam / TheSubZeroProject
  A multi-staged malware that contains a kernel mode rootkit and a remote system shell.
  ☆71Updated 3 years ago
• knight0x07 / BumbleCrypt
  A Bumblebee-inspired Crypter
  ☆80Updated 2 years ago
• AzAgarampur / PsForge
  Process Hollowing demonstration & explanation
  ☆34Updated 3 years ago
• nnot09 / direct-syscall
  A simple example on how to initiate a direct syscall on WoW64
  ☆11Updated 6 years ago
• realoriginal / bootdoor
  An initial proof of concept of a bootkit based on Cr4sh's DMABackdoorBoot
  ☆61Updated last year
• XShar / XssBot
  XssBot-Модульный резидентный бот с супер админкой
  ☆12Updated 2 years ago
• Idov31 / UdpInspector
  Listing UDP connections with remote address without sniffing.
  ☆30Updated last year
• hasherezade / shellc_encoder
  Standalone Metasploit-like XOR encoder for shellcode
  ☆46Updated 8 months ago
• realoriginal / blacklotus
  A attempt at replicating BLACKLOTUS capabilities, whilst not acting as a direct mimic.
  ☆87Updated last year
• brat-volk / EntomoLoader
  C++ Multi-Stage Semi-Polymorphic Malware Loader.
  ☆8Updated 3 years ago
• connormcgarr / EATGuard
  Implementation of an export address table protection mitigation, like Export Address Filtering (EAF)
  ☆95Updated last year
• loneicewolf / KernelMode-Code
  2022 Updated Kernelmode-Code
  ☆31Updated 10 months ago
• CarlosG13 / Process-Hypnosis-Debugger-assisted-control-flow-hijack
  ☆27Updated 10 months ago
• cocomelonc / 2022-06-05-malware-av-evasion-7
  Malware AV evasion via disable Windows Defender (Registry). C++
  ☆35Updated 2 years ago
• EvaStanAccount / MalwareDev
  ☆15Updated 3 years ago
• xenoscr / manual-syscall-detect
  A tool for detecting manual/direct syscalls in x86 and x64 processes using Nirvana Hooks.
  ☆106Updated 2 years ago
• zimnyaa / insomnia
  a stage1 DLL loader with sleep obfuscation
  ☆34Updated 2 years ago
• maziland / StackBombing
  Next gen process injection technique
  ☆44Updated 4 years ago
• rad9800 / VehApiResolve
  ☆105Updated 2 years ago
• xalicex / Get-DLL-and-Function-Addresses
  GetModuleHandle (via PEB) and GetProcAddress (via EAT) like
  ☆32Updated 2 years ago
• hasherezade / SweetDreams
  Implementation of Advanced Module Stomping and Heap/Stack Encryption
  ☆9Updated last year
• realoriginal / foliage
  A proof of concept I developed to improve Gargoyle back in 2018 to achieve true memory obfuscation from position independent code
  ☆43Updated 4 months ago
• Flawww / NtSyscaller
  Manually perform syscalls without going through any external API or DLL.
  ☆17Updated last year
• ZeroMemoryEx / URootkit
  user-mode Rootkit
  ☆102Updated 2 years ago
• xalicex / Unhook-Import-Address-Table
  Piece of code to detect and remove hooks in IAT
  ☆62Updated 2 years ago
• s4dbrd / ETWReader
  Read ETW Provider events. Inspired by ETWExplorer by Pavel Yosifovich
  ☆14Updated 7 months ago
• SolomonSklash / COM-Hijacking
  An example of COM hijacking using a proxy DLL.
  ☆25Updated 3 years ago
• 0x44F / WinKit
  💻 Windows 10 Kernel-mode rootkit
  ☆31Updated 2 years ago
• XaFF-XaFF / ZwProcessHollowing
  ZwProcessHollowing is a x64 process hollowing project which uses direct systemcalls, dll unhooking and RC4 payload decryption
  ☆81Updated last year
• matterpreter / cpuid
  A class to emulate the behavior of NtQuerySystemInformation when passed the SystemHypervisorDetailInformation information class
  ☆25Updated last year