fin3ss3g0d / IoDllProxyLoad
DLL proxy load example using the Windows thread pool API, I/O completion callback with named pipes, and C++/assembly
☆59Updated 11 months ago
Alternatives and similar repositories for IoDllProxyLoad:
Users that are interested in IoDllProxyLoad are comparing it to the libraries listed below
- ☆97Updated last year
- Execute dotnet app from unmanaged process☆70Updated 2 months ago
- stack spoofing☆79Updated 3 months ago
- EmbedExeLnk by x86matthew modified by d4rkiZ☆34Updated last year
- ☆52Updated last month
- Threadless shellcode injection tool☆63Updated 6 months ago
- converts sRDI compatible dlls to shellcode☆20Updated last month
- ☆85Updated 6 months ago
- ☆52Updated 2 months ago
- Combining 3 techniques (Threadless Injection + DLL Stomping + Caro-Kann) together to evade MDE.☆42Updated last year
- yet another sleep encryption thing. also used the default github repo name for this one.☆70Updated last year
- ☆19Updated last week
- Cobalt Strike UDRL for memory scanner evasion.☆47Updated last year
- Beacon Object Files (not Buffer Overflows)☆53Updated last year
- ☆93Updated 6 months ago
- SharpExShell automates the DCOM lateral movment technique which abuses ActivateMicrosoftApp method of Excel application.☆68Updated 10 months ago
- Exploiting the KsecDD Windows driver through Server Silos☆50Updated 3 months ago
- I have documented all of the AMSI patches that I learned till now☆74Updated last year
- BypassCredGuard CS BOF☆32Updated last month
- A remote process injection using process snapshotting based on https://gitlab.com/ORCA000/snaploader , in rust. It creates a sacrificial …☆44Updated last month
- ☆28Updated 6 months ago
- GPOAnalyzer is a tool designed to assist in parsing domain Group Policy Object (GPO) files located in the SYSVOL directory.☆25Updated 8 months ago
- Experimental PoC for unhooking API functions using in-memory patching, without VirtualProtect, for one specific EDR.☆39Updated last year
- Code snippets to add on top of cobalt strike sleep mask to achieve patchless hook on AMSI and ETW☆82Updated last year
- Simple ETW unhook PoC. Overwrites NtTraceEvent opcode to disable ETW at Nt-function level.☆46Updated last year