huoji120 / Etw-SyscallView external linksLinks
https://key08.com/index.php/2021/10/19/1375.html
☆71May 11, 2022Updated 3 years ago
Alternatives and similar repositories for Etw-Syscall
Users that are interested in Etw-Syscall are comparing it to the libraries listed below
Sorting:
- Detect removed thread from PspCidTable.☆75Mar 18, 2022Updated 3 years ago
- Basic experimentation with Windows drivers.☆17Mar 3, 2023Updated 2 years ago
- Hook NtDeviceIoControlFile with PatchGuard☆107May 10, 2022Updated 3 years ago
- Monitor ETW events for Windows process mitigation policies, with stack traces☆31Oct 7, 2022Updated 3 years ago
- Call NtCreateUserProcess directly as normal.☆76May 17, 2022Updated 3 years ago
- Walks the Process' VAD list to grab the PTE's corresponding to a usermode virtual address, all to get the physical address☆23Nov 22, 2021Updated 4 years ago
- c++ implementation of windows heavens gate☆70Feb 12, 2021Updated 5 years ago
- Open-source EDR kernel-component for system monitoring and DLL injection☆33Nov 14, 2020Updated 5 years ago
- 关于intel和amd指令行为不一样这件事☆62Apr 15, 2022Updated 3 years ago
- A simple example how to decrypt kernel debugger data block☆31Feb 8, 2021Updated 5 years ago
- Windows file system driver which allows to block access to files at run-time (C/C++, C#, WDK, SDK)☆13Jan 1, 2023Updated 3 years ago
- Load Dll into Kernel space☆39Aug 23, 2022Updated 3 years ago
- A kernel mode Windows rootkit in development.☆49Dec 31, 2021Updated 4 years ago
- 让Etwhook再次伟大! Make InfinityHook Great Again!☆147Jun 24, 2021Updated 4 years ago
- Using NtCreateFile and NtDeviceIoControlFile to realize the function of winsock（利用NtCreateFile和NtDeviceIoControlFile 实现winsock的功能 ）☆127Sep 9, 2022Updated 3 years ago
- A simple way to spoof return addresses using an exception handler☆43Aug 3, 2022Updated 3 years ago
- ☆39Oct 29, 2020Updated 5 years ago
- 滥用cow机制进行全局注入☆99Jan 1, 2021Updated 5 years ago
- kernel driver used to monitor the activity of BadlionAnticheat.sys by patching its IAT☆33Jul 9, 2021Updated 4 years ago
- A poc of embedding x64 code into x86 PE file☆20Sep 25, 2019Updated 6 years ago
- Kernel DLL Injector using NX Bit Swapping and VAD hide for hiding injected DLL☆220Nov 12, 2020Updated 5 years ago
- ☆18Mar 28, 2023Updated 2 years ago
- Simple DLL and client app that work together to hook all the functions in WinHvPlatform.dll in order to provide logging and introspection…☆21Dec 1, 2021Updated 4 years ago
- detect hypervisor with Nmi Callback☆42Sep 25, 2022Updated 3 years ago
- INF Studio for easier working with driver installation files☆39Nov 11, 2023Updated 2 years ago
- It's a minifilter used for transparent-encrypting.☆342Jul 28, 2025Updated 6 months ago
- direct systemcalls with a modern c++20 interface.☆45Jan 6, 2023Updated 3 years ago
- 沙箱测试,测评国内常见沙箱的代码与结论☆107Jul 3, 2021Updated 4 years ago
- Simple Demo of using Windows Hypervisor Platform☆29Jul 14, 2025Updated 7 months ago
- 研究和移除各种内核回调,在anti anti cheat的路上越走越远☆183Aug 26, 2022Updated 3 years ago
- Driver Loader/BE Bypass/Win Malware(lol)☆36Jun 25, 2019Updated 6 years ago
- Detect-KeAttachProcess by iterating through all processes as well as checking the context of the thread.☆119Feb 8, 2022Updated 4 years ago
- ☆16Oct 31, 2022Updated 3 years ago
- Radical Windows ARK☆251Apr 18, 2025Updated 9 months ago
- Bypasses for Windows kernel callbacks PatchGuard protection☆44Aug 15, 2021Updated 4 years ago
- codes for my blog post: https://secrary.com/Random/InstrumentationCallback/☆183Nov 30, 2017Updated 8 years ago
- Global DLL injector☆71May 16, 2021Updated 4 years ago
- Analyze Windows x64 Kernel Memory Layout☆129Nov 19, 2020Updated 5 years ago
- 简单安排一下 autochk.sys 这个rootkit☆73Mar 7, 2023Updated 2 years ago