Live memory analysis detecting malware IOCs in processes, modules, handles, tokens, threads, .NET assemblies, memory address space and environment variables. Dumps, detects and dissasemble hooks, shellcode, memory regions, modules and processes.
☆45Sep 22, 2024Updated 2 years ago
Alternatives and similar repositories for WhacAMole
Users that are interested in WhacAMole are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- ☆14Nov 24, 2022Updated 3 years ago
- ☆11Feb 19, 2023Updated 3 years ago
- ☆10Sep 11, 2026Updated last month
- Create a portable and minimized MSVC compilation environment, including x86/x64/cl/clang, etc.☆12Mar 14, 2025Updated last year
- Use hardware breakpoints to spoof the call stack for both syscalls and API calls☆205Jun 6, 2024Updated 2 years ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- DLL proxy load example using the Windows thread pool API, I/O completion callback with named pipes, and C++/assembly☆67Mar 19, 2024Updated 2 years ago
- CreateRemoteThreadPlus: how to pass multiple parameters to the remote thread function without shellcode.☆142Jul 10, 2025Updated last year
- A newer iteration of TitanLdr with some newer hooks, and design. A generic user defined reflective DLL I built to prove a point to Mudge …☆35Mar 20, 2023Updated 3 years ago
- Protect your process like ntoskrnl.exe☆15Jul 8, 2023Updated 3 years ago
- C# project to Reflectively load .Net assemblies in memory☆20Jun 19, 2024Updated 2 years ago
- ☆11Sep 11, 2023Updated 3 years ago
- Cobalt Strike UDRL for memory scanner evasion.☆50Dec 4, 2023Updated 2 years ago
- BasicEventViewer4 (BEV v4.0), this code will useful for All Blue/Purple Teams , RealTime Monitoring Sysmon Events , Mitre Attack Detectio…☆18Jun 22, 2023Updated 3 years ago
- pg bypass for win10-win11 (learn from NP)☆17Oct 28, 2025Updated last year
- Managed Database hosting by DigitalOcean • AdPostgreSQL, MySQL, MongoDB, Kafka, Valkey, and OpenSearch available. Automatically scale up storage and focus on building your apps.
- Beacon Object File (BOF) for identifying dependent child services of a given parent.☆19Jun 20, 2025Updated last year
- Execute a payload at each right click on a file/folder in the explorer menu for persistence☆172Mar 15, 2023Updated 3 years ago
- Monitors ETW for security relevant syscalls maintaining the set called by each unique process☆90May 17, 2023Updated 3 years ago
- AI-Native Team Studio. Build and run your own AI team.☆22Updated this week
- Some stuff for PHD2021☆14May 21, 2025Updated last year
- 32 bit process inject shellcode to 32 bit process and 64 bit process☆34May 8, 2023Updated 3 years ago
- Walks the CFG bitmap to find previously executable but currently hidden shellcode regions☆141May 17, 2023Updated 3 years ago
- GCC生成Shellcode框架☆18Apr 7, 2025Updated last year
- NailaoLoader: Hiding Execution Flow via Patching☆24Feb 27, 2025Updated last year
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- anti-ransomware file-system filter☆70Sep 3, 2024Updated 2 years ago
- A simple PoC to invoke an encrypted shellcode by using an hidden call☆116Nov 19, 2022Updated 3 years ago
- PoC memory injection detection agent based on ETW, for offensive and defensive research purposes☆300Apr 10, 2021Updated 5 years ago
- Memory API proxy via signed mozglue.dll☆41Jun 25, 2026Updated 4 months ago
- ☆108Jan 21, 2025Updated last year
- Detect EDR's exceptions by inspecting processes' loaded modules☆133Mar 15, 2024Updated 2 years ago
- An x64 position-independent shellcode stager that verifies the stage it retrieves prior to execution☆195Nov 27, 2024Updated last year
- Experimental PoC for unhooking API functions using in-memory patching, without VirtualProtect, for one specific EDR.☆41Jul 9, 2023Updated 3 years ago
- Basic implementation of Cobalt Strikes - User Defined Reflective Loader feature☆100Feb 28, 2023Updated 3 years ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- it's a driver injector or driver loader header lib(Windows)☆13Aug 5, 2023Updated 3 years ago
- Yet another llvm based obfuscator based on goron.☆18May 23, 2026Updated 5 months ago
- 学习windows驱动相关☆24Jul 31, 2019Updated 7 years ago
- Reduce Dynamic Analysis Detection Rates With Built-In Unhooker, Anti Analysis Techniques, And String Obfuscator Modules.☆21Dec 21, 2022Updated 3 years ago
- Bypass Userland EDR hooks by Loading Reflective Ntdll in memory from a remote server based on Windows ReleaseID to avoid opening a handle…☆306Aug 2, 2023Updated 3 years ago
- eXtensiable Malware Toolkit: Full Featured Golang C2 Framework with Awesome Features☆107Oct 2, 2026Updated last month
- ETWProcessMon2 is for Monitoring Process/Thread/Memory/Imageloads/TCPIP via ETW + Detection for Remote-Thread-Injection & Payload Detecti…☆322Mar 20, 2024Updated 2 years ago