michaellandi / exportstoc
Used to create wrappers and proxy libraries for Windows binaries.
☆74Updated 13 years ago
Alternatives and similar repositories for exportstoc:
Users that are interested in exportstoc are comparing it to the libraries listed below
- ☆69Updated last month
- Example code for EDR bypassing☆150Updated 6 years ago
- ☆50Updated 4 years ago
- ☆162Updated 3 years ago
- ☆197Updated 2 years ago
- signed-loaders documents Windows executables that can be used for side-loading DLLs.☆66Updated 6 years ago
- An command-line RPC method enumerator, born out of RPCView's awesomeness☆103Updated 5 years ago
- Load and execute COFF files and Cobalt Strike BOFs in-memory☆214Updated 2 years ago
- Convert PE files to a shellcode☆74Updated 4 years ago
- Windows PE - TLS (Thread Local Storage) Injector in C/C++☆104Updated 4 years ago
- ☆90Updated 3 years ago
- Use NT Native Registry API to create a registry that normal user can not query.☆90Updated 7 years ago
- Custom implementation of DbgHelp's MiniDumpWriteDump function. Uses static syscalls to replace low-level functions like NtReadVirtualMemo…☆118Updated 3 years ago
- PoC to demonstrate how CLR ETW events can be tampered.☆187Updated 5 years ago
- Example code for using named pipe output with beacon ReflectiveDLLs☆114Updated 4 years ago
- Inject shellcode to process using Windows NTAPI for bypassing EDRs and Antiviruses☆41Updated 4 years ago
- A Collection of In-Memory Shellcode Execution Techniques for Windows☆147Updated 5 years ago
- Weaponizing Gigabyte driver for priv escalation and bypass PPL☆68Updated 5 years ago
- A simple COM server which provides a component to run shellcode☆133Updated 4 years ago
- https://blog.f-secure.com/hiding-malicious-code-with-module-stomping/☆119Updated 5 years ago
- Project to check which Nt/Zw functions your local EDR is hooking☆185Updated 4 years ago
- APC DLL Injector with NtQueueApcThread and wake up thread support☆43Updated 7 years ago
- PoC: Rebuild A New Path Back to the Heaven's Gate (HITB 2021)☆103Updated 3 years ago
- Silence EDRs by removing kernel callbacks☆229Updated 4 years ago
- Overwrite a process's recovery callback and execute with WER☆103Updated 2 years ago
- An example of how to spawn a process with a spoofed parent PID (Visual C++)☆27Updated 6 years ago
- Small tool to get a SYSTEM shell☆130Updated 9 years ago
- A modified RunPE (process hollowing) technique avoiding the usage of SetThreadContext by appending a TLS section which calls the original…☆95Updated 5 years ago
- DoppelGate relies on reading ntdll on disk to grab syscall stubs, and patches these syscall stubs into desired functions to bypass Userla…☆121Updated 3 years ago
- Lists of AMSI triggers (VBA, JScript / VBScript)☆33Updated 5 years ago