Driver Initial Reconnaissance Tool
☆126Dec 26, 2019Updated 6 years ago
Alternatives and similar repositories for DIRT
Users that are interested in DIRT are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- ☆134Sep 14, 2020Updated 6 years ago
- Antivirus Emulator Fingerprints☆30Oct 12, 2018Updated 7 years ago
- A fork of https://github.com/SafeBreach-Labs/pinjectra with a practical implementation of Stack Bombing☆28Oct 22, 2020Updated 5 years ago
- PoC of BOOST-ed _EPROCESS.VadRoot iterating☆27May 21, 2014Updated 12 years ago
- A novel technique to communicate between threads using the standard ETHREAD structure☆116Feb 27, 2021Updated 5 years ago
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- a simple intel vt code both support x86 & x64. PatchGuard monitor.☆76Oct 28, 2021Updated 4 years ago
- reverse engineering extension plugin for windbg☆123Sep 30, 2019Updated 6 years ago
- Corsair LL Access driver abuse☆25Apr 16, 2021Updated 5 years ago
- A tool to help when dealing with Windows IOCTL codes or reversing Windows drivers.☆440Aug 22, 2018Updated 8 years ago
- AllMemPro☆46Jan 15, 2018Updated 8 years ago
- ☆13May 1, 2018Updated 8 years ago
- ☆21May 28, 2021Updated 5 years ago
- ☆408Mar 1, 2017Updated 9 years ago
- hooking KiUserApcDispatcher☆26Apr 3, 2017Updated 9 years ago
- Virtual machines for every use case on DigitalOcean • AdGet dependable uptime with 99.99% SLA, simple security tools, and predictable monthly pricing with DigitalOcean's virtual machines, called Droplets.
- An example of how x64 kernel shellcode can dynamically find and use APIs☆103May 14, 2020Updated 6 years ago
- Designed to learn OS specific anti-emulation patterns by fuzzing the Windows API.☆95Jul 7, 2020Updated 6 years ago
- An command-line RPC method enumerator, born out of RPCView's awesomeness☆106Jul 31, 2019Updated 7 years ago
- Three Tiny Examples of Directly Using Vista's NtCreateUserProcess☆90Nov 9, 2015Updated 10 years ago
- Enumerate and disable common sources of telemetry used by AV/EDR.☆864Mar 11, 2021Updated 5 years ago
- Some research on AltSystemCallHandlers functionality in Windows 10 20H1 18999☆243Nov 6, 2019Updated 6 years ago
- Silence EDRs by removing kernel callbacks☆236Dec 7, 2020Updated 5 years ago
- Hypervisor-based debugger☆192Dec 2, 2020Updated 5 years ago
- Anti-AV compilation☆44Oct 4, 2013Updated 12 years ago
- GPU virtual machines on DigitalOcean Gradient AI • AdGet to production fast with high-performance AMD and NVIDIA GPUs you can spin up in seconds. The definition of operational simplicity.
- NT AUTHORITY\SYSTEM☆43Jul 8, 2020Updated 6 years ago
- DriverBuddy is an IDA Python script to assist with the reverse engineering of Windows kernel drivers.☆382Jan 8, 2020Updated 6 years ago
- Pinjectra is a C/C++ OOP-like library that implements Process Injection techniques (with focus on Windows 10 64-bit)☆16Sep 4, 2020Updated 6 years ago
- Incident Response & Digital Forensics Debugging Extension☆399Dec 11, 2018Updated 7 years ago
- Adds a user-mode asynchronous procedure call (APC) object to the APC queue of the specified thread and spoof the Parent Process.☆157Jun 10, 2019Updated 7 years ago
- Simple tool to use LsaManageSidNameMapping get LSA to add or remove SID to name mappings.☆25Oct 25, 2020Updated 5 years ago
- CSharp Writeups for HackSys Extreme Vulnerable Driver☆45Dec 22, 2021Updated 4 years ago
- Reverse engineered source code of the autochk rootkit☆213Nov 1, 2019Updated 6 years ago
- Multi-purpose proof-of-concept tool based on CPU-Z CVE-2017-15303☆112Feb 25, 2018Updated 8 years ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- A driver that hooks C: volume using symbolic link callback to track all FS access to the volume☆108Apr 24, 2020Updated 6 years ago
- Example code for using named pipe output with beacon ReflectiveDLLs☆118Jun 24, 2020Updated 6 years ago
- Windows (ShadowMove) Socket Duplication☆85Apr 19, 2020Updated 6 years ago
- Proof of concept - Covert Channel using Windows Filtering Platform (C#)☆21Aug 29, 2021Updated 5 years ago
- Universal Unhooking☆324Sep 19, 2018Updated 8 years ago
- PoC to demonstrate how CLR ETW events can be tampered.☆190Mar 26, 2020Updated 6 years ago
- Research on Anti-malware and other related security solutions☆265Jul 25, 2020Updated 6 years ago