☆28Sep 17, 2024Updated 2 years ago
Alternatives and similar repositories for Kernel-Snooping
Users that are interested in Kernel-Snooping are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- SV-Assistant☆20Jan 31, 2024Updated 2 years ago
- Silence EDRs by removing kernel callbacks☆236Dec 7, 2020Updated 5 years ago
- ☆14Mar 8, 2019Updated 7 years ago
- Hijack NotifyRoutine for a kernelmode thread☆39Jun 4, 2022Updated 4 years ago
- neat way to detect memory read using nt layer function.☆13Aug 4, 2023Updated 3 years ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- This is the AV ("protection solution") used for my windows 10 rootkit main project. this includes the installer stager program, a service…☆13May 2, 2024Updated 2 years ago
- Loading Fileless Remote PE from URI to memory with argument passing and ETW patching and NTDLL unhooking and No New Thread technique I…☆11Jul 18, 2025Updated last year
- squad internal simple base☆18Nov 29, 2023Updated 2 years ago
- ☆14May 10, 2021Updated 5 years ago
- 参考taviso的代码逆向一下mpengine.dll☆22Jun 30, 2022Updated 4 years ago
- Simple IOCTL hooking driver for Kernel- User - Mode communication.☆11Jul 26, 2020Updated 6 years ago
- Using NtCreateFile and NtDeviceIoControlFile to realize the function of winsock（利用NtCreateFile和NtDeviceIoControlFile 实现winsock的功能）☆128Sep 9, 2022Updated 4 years ago
- Bypasses for Windows kernel callbacks PatchGuard protection☆44Aug 15, 2021Updated 5 years ago
- x86/x64 dll injector☆31May 17, 2022Updated 4 years ago
- Proton VPN Special Offer - Get 70% off • AdSpecial partner offer. Trusted by over 100 million users worldwide. Tested, Approved and Recommended by Experts.
- a demo for x86/x64's paging memory management learning, convert a virtual address from ring3 to physical address in ring0☆18Aug 26, 2017Updated 9 years ago
- direct systemcalls with a modern c++20 interface.☆45Jan 6, 2023Updated 3 years ago
- Turing-complete 64-bit virtual machine written in C++ and C#☆14May 11, 2026Updated 5 months ago
- x64 assembler library☆31Jun 7, 2024Updated 2 years ago
- Files for http://blog.deniable.org/posts/windows-callbacks/☆86Feb 26, 2022Updated 4 years ago
- Provides commands to read from and write to arbitrary kernel-mode memory for users with the Administrator privilege. HVCI compatible. No …☆25Jun 16, 2024Updated 2 years ago
- A simple tool for enumerating dynamic endpoints on a DCE/RPC remote or local endpoint mapper.☆16Oct 9, 2020Updated 6 years ago
- Elevate arbitrary MSR writes to kernel execution.☆55Sep 3, 2023Updated 3 years ago
- Bypassing EasyAntiCheat.sys self-integrity by abusing call hierarchy☆81Oct 6, 2022Updated 4 years ago
- Serverless GPU API endpoints on Runpod - Get Bonus Credits • AdSkip the infrastructure headaches. Auto-scaling, pay-as-you-go, no-ops approach lets you focus on innovating your application.
- Libraries written in inline assembly☆19Aug 7, 2023Updated 3 years ago
- What makes it page☆17Aug 24, 2022Updated 4 years ago
- x64HOOK库☆16Jan 14, 2020Updated 6 years ago
- Dont Call Me Back - Dynamic kernel callback resolver. Scan kernel callbacks in your system in a matter of seconds!☆258Jul 9, 2024Updated 2 years ago
- For Example. See Miro's Blog☆29Nov 26, 2022Updated 3 years ago
- DLL Unhooking☆12Mar 26, 2021Updated 5 years ago
- Monitor ETW events for Windows process mitigation policies, with stack traces☆30Oct 7, 2022Updated 4 years ago
- Use RTCore64 to map your driver on windows 11.☆173May 9, 2025Updated last year
- Open-source EDR kernel-component for system monitoring and DLL injection☆33Nov 14, 2020Updated 5 years ago
- Proton VPN Special Offer - Get 70% off • AdSpecial partner offer. Trusted by over 100 million users worldwide. Tested, Approved and Recommended by Experts.
- a simple intel vt code both support x86 & x64. PatchGuard monitor.☆76Oct 28, 2021Updated 5 years ago
- Using process hacker, i noticed that BANDICAM has a "FULLSCREEN" window which has all the properties to be hijacked to render our stuff (…☆14Jan 9, 2026Updated 9 months ago
- clearing traces of a loaded driver☆48Jul 2, 2022Updated 4 years ago
- x64 PE-COFF virtualization driven obfuscation engine☆58Oct 14, 2022Updated 4 years ago
- Exploiting ring0 memcpy-like functionality to disable Driver Signing Enforcement (DSE)☆18Apr 12, 2020Updated 6 years ago
- ☆51Sep 18, 2020Updated 6 years ago
- Wrapper for VMProtect Library (only MSVC)☆34Jul 6, 2018Updated 8 years ago