idan1288 / PHDetection
Process Hollowing Detection on a live system
☆13Updated 6 years ago
Related projects: ⓘ
- Clone running process with ZwCreateProcess☆58Updated 3 years ago
- Bypass UAC by abusing the Security Center CPL and hijacking a shell protocol handler☆26Updated 3 years ago
- ☆17Updated 3 years ago
- Simple PE Packer Which Encrypts .text Section☆45Updated 7 years ago
- ☆56Updated 2 years ago
- ☆36Updated 2 years ago
- Sysmon shenanigans☆65Updated 3 years ago
- A ready-made template for a project based on libpeconv.☆40Updated last year
- Parser for a custom executable format from Hidden Bee malware (first stage)☆39Updated last week
- Rite Of Passage ROP Injector☆33Updated 5 years ago
- ☆49Updated this week
- This x64dbg plugin allows you to upload your sample to Malcore and view the results.☆31Updated last year
- arbitrary kernel read/write in dbutil_2_3.sys, Proof of Concept Local Privilege Escalation to nt authority/system☆52Updated 2 years ago
- Windows GPU rootkit PoC by Team Jellyfish☆35Updated 9 years ago
- Tiny driver patch to allow kernel callbacks to work on Win10 21h1☆31Updated 2 years ago
- Process Injection without R/W target memory and without creating a remote thread☆19Updated 2 years ago
- CVE-2021-29337 - Privilege Escalation in MODAPI.sys (MSI Dragon Center)☆29Updated 2 years ago
- Weaponizing Gigabyte driver for priv escalation and bypass PPL☆68Updated 5 years ago
- ☆29Updated 2 years ago
- ☆11Updated 2 years ago
- PoC for hiding PE exports☆65Updated 3 years ago
- Local OXID Resolver (LCLOR) : Research and Tooling☆31Updated 3 years ago
- APC DLL Injector with NtQueueApcThread and wake up thread support☆44Updated 7 years ago
- ☆31Updated 4 years ago
- Dumps information about all the callback objects found in a dump file and the functions registered for them☆32Updated 3 years ago
- ☆20Updated 4 years ago
- A modified RunPE (process hollowing) technique avoiding the usage of SetThreadContext by appending a TLS section which calls the original…☆91Updated 4 years ago
- Support Windows OS Reversing by searching easily for references to functions across many DLLs☆33Updated 2 years ago
- ☆19Updated this week