A fast method to intercept syscalls from any user-mode process using InstrumentationCallback and detect any process using InstrumentationCallback.
☆37Sep 23, 2023Updated 3 years ago
Alternatives and similar repositories for InstrumentationCallbackToolKit
Users that are interested in InstrumentationCallbackToolKit are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- A plugin for x64dbg that allows you to hook the Local Security Authority Subsystem Service process to extract all possible TLS(On handsha…☆13Jul 6, 2024Updated 2 years ago
- Hooking the Windows usermode exception handler☆22Aug 13, 2024Updated 2 years ago
- Walks the Process' VAD list to grab the PTE's corresponding to a usermode virtual address, all to get the physical address☆23Nov 22, 2021Updated 4 years ago
- Undocumented BindFlt user mode API.☆19Mar 7, 2025Updated last year
- Various techniques used to bypass SMEP in the Windows Kernel.☆20Apr 20, 2025Updated last year
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- An advanced DKOM for drivers with "DRIVER_OBJECT"☆23Feb 19, 2023Updated 3 years ago
- Monitors ETW for security relevant syscalls maintaining the set called by each unique process☆90May 17, 2023Updated 3 years ago
- Templated Obfuscation example in C++ for protecting/hiding values in memory☆39Feb 1, 2025Updated last year
- Simple KDMapper driver dumper. Unlike other dumpers, this dumper dumps the PE headers of the image too.☆18May 10, 2024Updated 2 years ago
- Reversed WintaPix Malware Source code | That targets countries in the Middle East and abuse KeServiceDescriptorTable(SSDT), persistence a…☆21Jul 6, 2024Updated 2 years ago
- 大部分常见windows内核文件合集 感谢以下网站给出的版本号参考☆17Mar 4, 2026Updated 7 months ago
- LLVM based code obfuscator passes☆21Oct 4, 2026Updated 3 weeks ago
- A lightweight C++ library designed for function interception within injected DLLs, providing a streamlined approach to modifying applicat…☆45Oct 19, 2023Updated 3 years ago
- modern c++ wrapper around the microsoft portable executable file format☆43Nov 22, 2025Updated 11 months ago
- End-to-end encrypted email - Proton Mail • AdSpecial offer: 40% Off Yearly / 80% Off First Month. All Proton services are open source and independently audited for security.
- All my POC related to malware development☆15Aug 4, 2026Updated 2 months ago
- ☆27Dec 29, 2021Updated 4 years ago
- ☆26Jul 15, 2023Updated 3 years ago
- Bypassing kernel patch protection at runtime☆22Aug 16, 2026Updated 2 months ago
- Public Release☆16Mar 27, 2019Updated 7 years ago
- Detour hooking IRQ1 ISR through IDT (Interrupt Descriptor Table)☆21Mar 16, 2026Updated 7 months ago
- HVCI/kCET-aware bugcheck suppressor PoC☆22May 11, 2026Updated 5 months ago
- Walks the CFG bitmap to find previously executable but currently hidden shellcode regions☆141May 17, 2023Updated 3 years ago
- ☆22Aug 28, 2024Updated 2 years ago
- Wordpress hosting with auto-scaling - Free Trial Offer • AdFully Managed hosting for WordPress and WooCommerce businesses that need reliable, auto-scalable performance. Cloudways SafeUpdates now available.
- 对Windbg以Exdi模式下调试windows做一些修复☆21Aug 25, 2023Updated 3 years ago
- ollvm (obfuscator llvm) plugin ported to llvm 23. add bogus control flow, flattening, splitting, substitution to obfuscate your C/C++ cod…☆20Oct 10, 2026Updated 3 weeks ago
- This script is used to unload PsSetCreateProcessNotifyRoutineEx, PsSetCreateProcessNotifyRoutine, PsSetLoadImageNotifyRoutine and PsSetCr…☆66Feb 11, 2024Updated 2 years ago
- INTEL PIN dbi based process tracer☆19Jun 25, 2020Updated 6 years ago
- Allows for same-file KernelMode function execution using Encrypted addresses of Functions☆55Apr 23, 2026Updated 6 months ago
- A minimalistic way to spoof return addresses without using exceptions☆21Jul 26, 2022Updated 4 years ago
- A class to emulate the behavior of NtQuerySystemInformation when passed the SystemHypervisorDetailInformation information class☆28Sep 15, 2023Updated 3 years ago
- Demonstrates that NvAPI_D3D11_WksReadScanout (undocumented, interface 0xBCB1C536) can read the GPU scanout buffer directly, bypassing any…☆98Mar 8, 2026Updated 7 months ago
- really ?☆12Feb 29, 2024Updated 2 years ago
- Managed Database hosting by DigitalOcean • AdPostgreSQL, MySQL, MongoDB, Kafka, Valkey, and OpenSearch available. Automatically scale up storage and focus on building your apps.
- Archive R/W into any protected process by changing the value of KTHREAD->PreviousMode☆162Jul 31, 2022Updated 4 years ago
- Use NtSetInformationThread(ThreadBreakOnTermination) for anti-debugging☆16Sep 21, 2019Updated 7 years ago
- Winsocket for Cobalt Strike.☆104Jul 6, 2023Updated 3 years ago
- Win32 PE Anti-RE and Anti-debugging Framework☆13May 14, 2019Updated 7 years ago
- POC For CVE-2022-24483☆13Apr 12, 2022Updated 4 years ago
- ☆10Oct 24, 2026Updated last week
- An open-source tool for efficiently parsing x64dbg trace files (.trace32 & .trace64).☆50Jan 20, 2026Updated 9 months ago