kkent030315 / NoPatchGuardCallback
x64 Windows PatchGuard bypass, register process-creation callbacks from unsigned code
☆196Updated 3 years ago
Related projects ⓘ
Alternatives and complementary repositories for NoPatchGuardCallback
- Code Injection, Inject malicious payload via pagetables pml4.☆226Updated 3 years ago
- x64 Windows kernel code execution via user-mode, arbitrary syscall, vulnerable IOCTLs demonstration☆219Updated 2 years ago
- Load your driver like win32k.sys☆247Updated 2 years ago
- Elevate a process to be a protected process☆142Updated 5 years ago
- Kernel LdrLoadDll injector☆258Updated 6 years ago
- Browse Page Tables on Windows (Page Table Viewer)☆182Updated 2 years ago
- ☆152Updated 5 years ago
- A proof of concept demonstrating instrumentation callbacks on Windows 10 21h1 with a TLS variable to ensure all syscalls are caught.☆117Updated 2 years ago
- Bypassing PatchGuard on modern x64 systems☆245Updated last year
- Using Microsoft Warbird to automatically unpack and execute encrypted shellcode in ClipSp.sys without triggering PatchGuard☆236Updated 2 years ago
- Hygieia, a vulnerable driver traces scanner written in C++ as an x64 Windows kernel driver.☆135Updated 2 years ago
- Analyze patches in a process☆245Updated 3 years ago
- x86 PE Mutator☆212Updated last year
- APC Internals Research Code☆158Updated 4 years ago
- PoC capable of detecting manual syscalls from usermode.☆182Updated 3 years ago
- Bootkit for Windows Sandbox to disable DSE/PatchGuard.☆258Updated 3 weeks ago
- Exploit MsIo vulnerable driver☆83Updated 3 years ago
- Manual DLL Injector using Thread Hijacking.☆231Updated 6 years ago
- Custom GetProcAddress, GetModuleHandleA and some dbghelp.dll functions☆82Updated 5 years ago
- NINA: No Injection, No Allocation x64 Process Injection Technique☆195Updated 4 years ago
- C++ library for parsing and manipulating PE files statically and dynamically.☆83Updated last year
- Easy Anti PatchGuard☆214Updated 3 years ago
- A mapper that maps shellcode into loaded large page drivers☆223Updated 2 years ago
- Some source code to demonstrate avoiding certain direct syscall detections by locating and JMPing to a legitimate syscall instruction wit…☆212Updated last year
- Loads a signed kernel driver which allows you to map any driver to kernel mode without any traces of the signed / mapped driver.☆270Updated 3 years ago
- Some research on AltSystemCallHandlers functionality in Windows 10 20H1 18999☆204Updated 5 years ago
- Resolve DOS MZ executable symbols at runtime☆93Updated 2 years ago
- A library to develop kernel level Windows payloads for post HVCI era☆365Updated 3 years ago
- Reverse engineered source code of the autochk rootkit☆196Updated 5 years ago