huoji120 / white_patch_detect
通杀检测基于白文件patch黑代码的免杀技术的后门
☆91Updated 3 months ago
Related projects ⓘ
Alternatives and complementary repositories for white_patch_detect
- 免杀计划任务进行权限维持,过主流杀软。 A schtask tool bypass anti-virus☆66Updated 2 years ago
- 复现《EDR的梦魇:Storm-0978使用新型内核注入技术“Step Bear”》☆87Updated last week
- 通过ACPI检测沙箱☆43Updated last year
- Binary Hollowing☆53Updated 2 months ago
- vehsyscall:a syscall project that may bypass EDR☆42Updated 8 months ago
- ☆89Updated 3 years ago
- Resolve the issue of DLLmain function in white and black DLLs hanging when calling shellcode☆104Updated 5 months ago
- shellcode生成框架☆78Updated 3 months ago
- 一种通过进程注入实现强制关闭部分杀软进程的方法(以360安全卫士和360杀毒为例)☆119Updated 10 months ago
- Red team tool designed for quickly identifying hijackable programs, evading antivirus software, and EDR (Endpoint Detection and Response)…☆58Updated 6 months ago
- ☆49Updated 3 months ago
- more conveniently Visual-Studio-BOF-template☆53Updated last year
- Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from mem…☆32Updated 6 months ago
- XOR 加密 分离免杀☆63Updated 10 months ago
- 简单安排一下 autochk.sys 这个rootkit☆67Updated last year
- Get password/cookie/history from browser and use devtools protocol to bypass edr monitoring☆54Updated 8 months ago
- 白加黑的快速生成器(针对IAT类型)☆93Updated 2 years ago
- IDA Python script for generating Windows x86 shellcode with one click☆34Updated last year
- A tool that expands the size of the text section in a PE file without loss, supporting both 32-bit and 64-bit programs.☆22Updated 6 months ago
- Amazing Obfuscator; 支持混淆 ShellCode 甚至 EXE; Support obfuscating ShellCode, even EXE.☆31Updated this week
- 一个demo☆23Updated 7 months ago
- Rust 重构的 sRDI☆11Updated 2 months ago
- Shellcode Reductio Entropy Tools☆62Updated last year
- File entropy calculator - Golang☆22Updated 9 months ago
- 过360拦截加载无驱动签名☆59Updated 3 years ago
- Self Cleanup in post-ex job☆42Updated 2 months ago
- kill AV/EDR☆21Updated last year
- 基于个人习惯使用C/C++的shellcode开发项目模板☆19Updated 2 months ago
- 将PE文件进行AES加密,然后从远程拉取加载内存中实现免杀☆34Updated last year