Dirty PoC on how to abuse S1's VEH for Vectored Syscalls and Local Execution
☆47Oct 11, 2025Updated last year
Alternatives and similar repositories for SentinelBruh
Users that are interested in SentinelBruh are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- Prime a process for injection when S1 is present☆13Feb 8, 2025Updated last year
- Windows Portable Device COM BOF☆17Mar 30, 2026Updated 7 months ago
- Windows User-Mode Shellcode Development Framework (WUMSDF)☆162Jul 15, 2026Updated 3 months ago
- Mentally ill EtwTi parser☆74Jan 11, 2026Updated 9 months ago
- PhantomsGate: Advanced Shellcode Injection Technique☆28Jul 15, 2024Updated 2 years ago
- GPUs on demand by Runpod - Special Offer Available • AdRun AI, ML, and HPC workloads on powerful cloud GPUs—without limits or wasted spend. Deploy GPUs in under a minute and pay by the second.
- Proof of concept demonstrating a method of proxying syscalls indirectly☆10Jul 3, 2024Updated 2 years ago
- Generating legitimate call stack frame along with indirect syscalls by abusing Vectored Exception Handling (VEH) to bypass User-Land EDR …☆311Jul 31, 2024Updated 2 years ago
- A modern Rust implementation of the original Stardust project, providing a sophisticated 32/64-bit shellcode template that features posit…☆64Mar 17, 2025Updated last year
- Implementing an early exception handler for hooking and threadless process injection without relying on VEH or SEH☆140Aug 31, 2025Updated last year
- ☆37May 19, 2026Updated 5 months ago
- ☆110Aug 21, 2024Updated 2 years ago
- ☆140Jan 16, 2025Updated last year
- RunPE implementation with multiple evasive techniques (2)☆288Sep 25, 2025Updated last year
- Two new offensive techniques using Windows Fibers: PoisonFiber (The first remote enumeration & Fiber injection capability POC tool) Phan…☆315Sep 18, 2024Updated 2 years ago
- Proton VPN Special Offer - Get 70% off • AdSpecial partner offer. Trusted by over 100 million users worldwide. Tested, Approved and Recommended by Experts.
- Post-ex tool to interact with chromium browser when CDP is enabled☆47May 15, 2026Updated 5 months ago
- Detects Module Stomping as implemented by Cobalt Strike☆17Dec 13, 2020Updated 5 years ago
- ☆126Sep 1, 2024Updated 2 years ago
- Using LNK files and user input simulation to start processes under explorer.exe☆33Sep 21, 2024Updated 2 years ago
- A synergized Visual Studio and Rust development environment☆18Jan 25, 2025Updated last year
- ☆59Jun 10, 2026Updated 4 months ago
- Busybox-style Beacon Object Files for *nix post-exploitation. Reimplements common Unix utilities as BOFs for use in stripped environments…☆45Jun 14, 2026Updated 4 months ago
- A proof of concept demonstrating the DLL-load proxying using undocumented Syscalls.☆410Jan 11, 2026Updated 9 months ago
- Admin to Kernel code execution using the KSecDD driver☆274Apr 19, 2024Updated 2 years ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- Reversed cassandra source code for educational purposes☆36Jul 3, 2026Updated 3 months ago
- Zero EAT touch way to retrieve function addresses (GetProcAddress on steroids)☆147Mar 16, 2024Updated 2 years ago
- Intel.AES-NI: Leveraging Intel AES-NI for AES-128 & AES-256 Encryption Modes☆27Jun 10, 2025Updated last year
- StoneKeeper C2, an experimental EDR evasion framework for research purposes☆206Dec 25, 2024Updated last year
- .NET CLR-Stomping☆148May 20, 2026Updated 5 months ago
- PIC shellcode (C/C++) development toolkit designed for malware developers.☆136Dec 23, 2025Updated 10 months ago
- Demonstration of Early Bird APC Injection - MITRE ID T1055.004☆35Oct 31, 2023Updated 2 years ago
- Bypass user-land hooks by syscall tampering via the Trap Flag☆143Aug 25, 2025Updated last year
- NailaoLoader: Hiding Execution Flow via Patching☆24Feb 27, 2025Updated last year
- Managed Database hosting by DigitalOcean • AdPostgreSQL, MySQL, MongoDB, Kafka, Valkey, and OpenSearch available. Automatically scale up storage and focus on building your apps.
- LLVM plugin to transparently apply stack spoofing and indirect syscalls to Windows x64 native calls at compile time.☆329Jan 17, 2024Updated 2 years ago
- Bring your own Unwind Data Framework☆178Mar 15, 2026Updated 7 months ago
- Call Stack Spoofing for Rust☆223Jan 28, 2026Updated 9 months ago
- Evasive shellcode loader☆400Oct 17, 2024Updated 2 years ago
- Process Injection using Thread Name☆309Apr 18, 2025Updated last year
- TypeLib persistence technique☆151Oct 22, 2024Updated 2 years ago
- BOF template with boflink and mutator kit support☆53Jan 8, 2026Updated 9 months ago