Alternatives and similar repositories for CISpotter

Users that are interested in CISpotter are comparing it to the libraries listed below

• moccajoghurt / MemWars

  View on GitHub
  ☆44Oct 7, 2018Updated 7 years ago
• alfarom256 / MinifilterResearch

  View on GitHub
  ☆16Oct 31, 2022Updated 3 years ago
• waleedassar / ALPC_CLIENT_SERVER

  View on GitHub
  Demo to show how write ALPC Client & Server using native Ntdll.dll syscalls.
  ☆21Jan 25, 2022Updated 4 years ago
• dilibili / Hook_KiUserExceptionDispatcher

  View on GitHub
  R3劫持所有异常
  ☆15Jan 4, 2021Updated 5 years ago
• boom-cr3 / NotifyRoutineHijackThread

  View on GitHub
  Hijack NotifyRoutine for a kernelmode thread
  ☆41Jun 4, 2022Updated 3 years ago
• alexvogt91 / NetDriver

  View on GitHub
  kernel-mode TDI client which can send and receive HTTP requests
  ☆56Jun 9, 2018Updated 7 years ago
• alfarom256 / UserVAtoPhysical

  View on GitHub
  Walks the Process' VAD list to grab the PTE's corresponding to a usermode virtual address, all to get the physical address
  ☆23Nov 22, 2021Updated 4 years ago
• Peribunt / Wow64-HeavensGate

  View on GitHub
  Basic utilities for executing, reading and writing 64-bit data in a 32-bit WoW64 process
  ☆19Jul 8, 2022Updated 3 years ago
• alal4465 / HeavensGateHook

  View on GitHub
  Hooking Heavens Gate in a weekend
  ☆13Jan 1, 2022Updated 4 years ago
• alal4465 / Practical-Reverse-Engineering-Solutions

  View on GitHub
  Some drivers I've written while solving exercises from Practical Reverse Engineering
  ☆15Jan 9, 2022Updated 4 years ago
• Dy-Baby / DSEDodge-Signed-Kernel-Driver

  View on GitHub
  ☆13Aug 24, 2022Updated 3 years ago
• zer0mem / VadScanner

  View on GitHub
  PoC of BOOST-ed _EPROCESS.VadRoot iterating
  ☆27May 21, 2014Updated 11 years ago
• codereversing / ted_api

  View on GitHub
  ☆35Oct 18, 2022Updated 3 years ago
• kagasu / VEHTest

  View on GitHub
  Example of making debugger using Hardware Breakpoint + VEH
  ☆18May 13, 2021Updated 4 years ago
• KelvinMsft / PerfMon

  View on GitHub
  first commit
  ☆64Oct 29, 2020Updated 5 years ago
• yardenshafir / InformationClasses

  View on GitHub
  Documenting system information classes and their uses
  ☆56Oct 18, 2021Updated 4 years ago
• SHA-MRIZ / FsMinfilterHooking

  View on GitHub
  ☆33Dec 22, 2020Updated 5 years ago
• Vicshann / PEProtectDrv

  View on GitHub
  Some crazy PE executables protection kernel driver
  ☆20May 2, 2020Updated 5 years ago
• gigabitwize / dank

  View on GitHub
  Driver Loader/BE Bypass/Win Malware(lol)
  ☆36Jun 25, 2019Updated 6 years ago
• Wh04m1001 / IFaultrepElevatedDataCollectionUAC

  View on GitHub
  ☆133Oct 14, 2022Updated 3 years ago
• ZaweSec / KasperskyHook_NewKSDriver

  View on GitHub
  ☆34Aug 14, 2023Updated 2 years ago
• NoMercy-ac / SystemHealthCheck

  View on GitHub
  Windows system repair tool
  ☆18Jun 2, 2021Updated 4 years ago
• yardenshafir / cet-research

  View on GitHub
  A collection of tools, source code, and papers researching Windows' implementation of CET.
  ☆88Oct 6, 2020Updated 5 years ago
• omerk2511 / NotifyRoutinesResearch

  View on GitHub
  A research project about Windows notify routines.
  ☆38Jul 31, 2020Updated 5 years ago
• aaaddress1 / wow64Jit

  View on GitHub
  Call 32bit NtDLL API directly from WoW64 Layer
  ☆62Nov 18, 2020Updated 5 years ago
• wsh993390188 / SV-Assisstant

  View on GitHub
  SV-Assistant
  ☆21Jan 31, 2024Updated 2 years ago
• wyexe / MemoryWatchTool

  View on GitHub
  ☆18Dec 5, 2016Updated 9 years ago
• chkpizza / runtime

  View on GitHub
  VEH Redirect & VEH Debugger
  ☆23May 18, 2020Updated 5 years ago
• DenuvoSoftwareSolutions / DVRT

  View on GitHub
  How Meltdown and Spectre haunt Anti-Cheat: DVRT details
  ☆22Aug 21, 2024Updated last year
• gmh5225 / FakeEnclave

  View on GitHub
  A poc that abuses Enclave
  ☆40Sep 8, 2022Updated 3 years ago
• connormcgarr / Kernel-Escalation-of-Privileges-Payloads

  View on GitHub
  NT AUTHORITY\SYSTEM
  ☆43Jul 8, 2020Updated 5 years ago
• hugsy / shared-kernel-user-section-driver

  View on GitHub
  Experiment to use sections as User/Kernelmode comm vector
  ☆22Apr 7, 2023Updated 2 years ago
• senko37 / createprocessnotify-hook

  View on GitHub
  PsSetCreateProcessNotifyRoutine/Ex/Ex2 hook
  ☆12May 30, 2024Updated last year
• itm4n / Pentest-Windows

  View on GitHub
  Windows internals and exploitation tricks
  ☆112Nov 9, 2025Updated 3 months ago
• Zero-Tang / SimpleWhpDemo

  View on GitHub
  Simple Demo of using Windows Hypervisor Platform
  ☆29Jul 14, 2025Updated 7 months ago
• kyREcon / IsKernelDebuggerPresent

  View on GitHub
  Detects if a Kernel mode debugger is active by reading the value of KUSER_SHARED_DATA.KdDebuggerEnabled. It is a high level and portable …
  ☆23Sep 18, 2017Updated 8 years ago
• Vicshann / GInjer

  View on GitHub
  Global DLL injector
  ☆71May 16, 2021Updated 4 years ago
• gognl / VMBR

  View on GitHub
  A VMBR (Virtual-Machine Based Rootkit) which runs a guest OS and sends the attacker its data
  ☆28Apr 27, 2024Updated last year
• orca-eaa5a / mac-defender

  View on GitHub
  ☆11Jan 8, 2022Updated 4 years ago