Alternatives and similar repositories for PichichiH0ll0wer

Users that are interested in PichichiH0ll0wer are comparing it to the libraries listed below

• Z4kSec / IoctlHunter
  IoctlHunter is a command-line tool designed to simplify the analysis of IOCTL calls made by userland software targeting Windows drivers.
  ☆104Updated last year
• Faran-17 / Hellshazzard
  Indirect Syscall implementation to bypass userland NTAPIs hooking.
  ☆84Updated last year
• ghostbyt3 / BYOVDFinder
  Identifies LOLDrivers that are not blocked by the active HVCI policy — ideal for BYOVD scenarios.
  ☆73Updated 4 months ago
• caueb / ThreadlessStompingKann
  Combining 3 techniques (Threadless Injection + DLL Stomping + Caro-Kann) together to evade MDE.
  ☆69Updated last year
• BeetleChunks / Obligato
  This project is an implant framework designed for long term persistent access to Windows machines.
  ☆109Updated 2 years ago
• ioncodes / SilentLoad
  "Service-less" driver loading
  ☆166Updated last year
• Karkas66 / CelestialSpark
  Version 2 - A modern 64-bit position independent meterpreter and Sliver compatible reverse_TCP Staging Shellcode based on Cracked5piders …
  ☆102Updated 8 months ago
• Offensive-Panda / DV_NEW
  This is the combination of multiple evasion techniques to evade defenses. (Dirty Vanity)
  ☆51Updated last year
• x0reaxeax / PageSplit
  Splitting and executing shellcode across multiple pages
  ☆103Updated 2 years ago
• jakobfriedl / BenevolentLoader
  Shellcode loader using direct syscalls via Hell's Gate and payload encryption.
  ☆99Updated last year
• mansk1es / GhostFart
  ☆137Updated 2 years ago
• Idov31 / NidhoggScript
  NidhoggScript is a tool to generate "script" file that allows execution of multiple commands for Nidhogg
  ☆50Updated last year
• naksyn / ModuleShifting
  Stealthier variation of Module Stomping and Module Overloading injection techniques that reduces memory IoCs. Implemented in Python ctype…
  ☆125Updated 2 years ago
• CaptainNox / Hypnos
  A more reliable way of resolving syscall numbers in Windows
  ☆52Updated last year
• naksyn / Embedder
  Embedder is a collection of sources in different languages to embed Python interpreter with minimal dependencies
  ☆122Updated last year
• Maldev-Academy / TrapFlagForSyscalling
  Bypass user-land hooks by syscall tampering via the Trap Flag
  ☆136Updated 3 months ago
• pygrum / gimmick
  Section-based payload obfuscation technique for x64
  ☆64Updated last year
• rad9800 / FileRenameJunctionsEDRDisable
  ☆159Updated last year
• OtterHacker / Hooker
  ☆108Updated last year
• patrickt2017 / VEHNetLoader
  Another version of .NET loader provides capabilities of bypassing ETW and AMSI, utilizing VEH for syscalls and loading .NET assemblies
  ☆49Updated 5 months ago
• Print3M / epic
  Extensible Position Independent Code – shellcode (C/C++) development and building toolkit designed for developer experience, predictabili…
  ☆100Updated last month
• MaorSabag / SideLoadingDLL
  Do some DLL SideLoading magic
  ☆89Updated 2 years ago
• winterknife / SILVERPICK
  Windows User-Mode Shellcode Development Framework (WUMSDF)
  ☆117Updated 3 weeks ago
• gatariee / ldrgen
  Template-based generation of shellcode loaders
  ☆79Updated last year
• Cipher7 / havoc-PoolParty
  Windows Thread Pool Injection Havoc Implementation
  ☆32Updated last year
• fern89 / ghostwriting-2
  A process injection technique using only thread context manipulation
  ☆39Updated last year
• whokilleddb / function-collections
  A collection of PoCs to do common things in unconventional ways
  ☆120Updated 3 months ago
• MEhrn00 / boflink
  Linker for Beacon Object Files
  ☆134Updated 2 weeks ago
• zero2504 / FrostLock-Injection
  FrostLock Injection is a freeze/thaw-based code injection technique that uses Windows Job Objects to temporarily freeze (suspend) a targe…
  ☆41Updated 8 months ago
• WKL-Sec / FuncAddressPro
  A stealthy, assembly-based tool for secure function address resolution, offering a robust alternative to GetProcAddress.
  ☆74Updated last year