A process overwriting its own PEB to make an illusion that it has been loaded from a different path.
☆100Jun 24, 2021Updated 5 years ago
Alternatives and similar repositories for process_chameleon
Users that are interested in process_chameleon are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- Windows process injection methods☆21Jul 18, 2021Updated 5 years ago
- A more stealthy variant of "DLL hollowing"☆369Mar 8, 2024Updated 2 years ago
- ChimeraPE (a PE injector type - alternative to: RunPE, ReflectiveLoader, etc) - a template for manual loading of EXE, loading imports pay…☆231Mar 22, 2023Updated 3 years ago
- My implementation of enSilo's Process Doppelganging (PE injection technique)☆647Aug 30, 2022Updated 4 years ago
- Demos of various (also non standard) persistence methods used by malware☆232Mar 5, 2023Updated 3 years ago
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- Шаблон полнофункционального драйвера и обёртки над ядерным API☆109Aug 28, 2016Updated 10 years ago
- A demo implementation of a well-known technique used by some malware to evade userland hooking, using my library: libpeconv.☆20Apr 13, 2018Updated 8 years ago
- A simple commandline injector using classic DLL injection☆163Apr 21, 2026Updated 6 months ago
- ☆84Aug 26, 2024Updated 2 years ago
- Parser for a custom executable formats from Hidden Bee and Rhadamanthys malware☆60Aug 6, 2025Updated last year
- Demo List cm/ps/ob/minifilter callback And Patch/Bypass it☆29Dec 5, 2017Updated 8 years ago
- Transacted Hollowing - a PE injection technique, hybrid between ProcessHollowing and ProcessDoppelgänging☆609Mar 8, 2024Updated 2 years ago
- Decoders for 7ev3n ransomware☆17Oct 24, 2016Updated 10 years ago
- Execute an arbitrary command within the context of another process☆20Jun 28, 2019Updated 7 years ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- Set of antianalysis techniques found in malware☆133Aug 25, 2023Updated 3 years ago
- Process Ghosting - a PE injection technique, similar to Process Doppelgänging, but using a delete-pending file instead of a transacted fi…☆698Mar 11, 2024Updated 2 years ago
- Archive of ransomware decryptors☆35Dec 7, 2017Updated 8 years ago
- Simple remote administration tool. Written in c++ and MASM.☆18May 16, 2018Updated 8 years ago
- DoublePulsar (Position-Independent) Shellcode (Windows 7 SP1 x64)☆25Mar 11, 2020Updated 6 years ago
- ☆14May 1, 2021Updated 5 years ago
- Standalone Metasploit-like XOR encoder for shellcode☆54May 12, 2024Updated 2 years ago
- UI application that can compare PE images in memory or in raw PE file☆19Feb 17, 2014Updated 12 years ago
- ☆19Jul 20, 2015Updated 11 years ago
- Proton VPN Special Offer - Get 70% off • AdSpecial partner offer. Trusted by over 100 million users worldwide. Tested, Approved and Recommended by Experts.
- Simple header only library to change return address on current stack frame.☆21Sep 4, 2016Updated 10 years ago
- Analysing and defeating PatchGuard universally☆34Nov 4, 2020Updated 5 years ago
- Set of my small utils related to cryptography, encoding, decoding etc☆96Sep 1, 2025Updated last year
- Modify process handle permissions☆60Nov 30, 2016Updated 9 years ago
- hooking KiUserApcDispatcher☆26Apr 3, 2017Updated 9 years ago
- A small library helping to parse commandline parameters (for C/C++)☆59Apr 7, 2026Updated 6 months ago
- ☆14Jul 22, 2024Updated 2 years ago
- Analyze PatchGuard☆56Aug 19, 2018Updated 8 years ago
- Converts a DLL into EXE☆814Jul 23, 2023Updated 3 years ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- ☆46Oct 7, 2018Updated 8 years ago
- A set of small utilities, helpers for PIN tracers☆40Feb 15, 2026Updated 8 months ago
- Implementation of Advanced Module Stomping and Heap/Stack Encryption☆11Jul 25, 2023Updated 3 years ago
- PowerLoaderEx - Advanced Code Injection Technique for x32 / x64☆385Apr 17, 2017Updated 9 years ago
- ☆34Jul 28, 2018Updated 8 years ago
- An example of PE hollowing injection technique☆26Jun 28, 2019Updated 7 years ago
- Detects if a Kernel mode debugger is active by reading the value of KUSER_SHARED_DATA.KdDebuggerEnabled. It is a high level and portable …☆25Sep 18, 2017Updated 9 years ago