Hollowfind is a Volatility plugin to detect different types of process hollowing techniques used in the wild to bypass, confuse, deflect and divert the forensic analysis techniques. The plugin detects such attacks by finding discrepancy in the VAD and PEB, it also disassembles the address of entry point to detect any redirection attempts and als…
☆142Sep 29, 2022Updated 4 years ago
Alternatives and similar repositories for HollowFind
Users that are interested in HollowFind are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- Psinfo is a Volatility plugin which collects the process related information from the VAD (Virtual Address Descriptor) and PEB (Process E…☆40Sep 24, 2016Updated 10 years ago
- Minifilter Driver☆15Feb 10, 2017Updated 9 years ago
- PoC for detecting and dumping process hollowing code injection☆53Oct 23, 2018Updated 8 years ago
- The project is a demo solution for one of the anti-rootkit techniques aimed on overcoming splicers☆34Mar 13, 2017Updated 9 years ago
- The internal Windows structures hack to create the in-process private ETW session☆14Feb 22, 2017Updated 9 years ago
- Serverless GPU API endpoints on Runpod - Get Bonus Credits • AdSkip the infrastructure headaches. Auto-scaling, pay-as-you-go, no-ops approach lets you focus on innovating your application.
- Notes my learning steps about Windows-NT☆23May 18, 2017Updated 9 years ago
- Automatically exported from code.google.com/p/lvdun☆13Dec 17, 2016Updated 9 years ago
- PoC for detecting and dumping code injection (built and extended on UnRunPE)☆58Oct 23, 2018Updated 8 years ago
- A tool to help malware analysts tell that the sample is injecting code into other process.☆79Aug 12, 2015Updated 11 years ago
- API Tracker by Cysinfo Team☆22Oct 12, 2016Updated 10 years ago
- Obtain remote process cookies by performing a brute-force attack on ntdll.RtlDecodePointer using known pointer encodings.☆22May 31, 2017Updated 9 years ago
- win7 apc注入不支持win10☆18Mar 29, 2019Updated 7 years ago
- User-mode process cross-checking utility intended to detect naive malware hiding itself by hooking IAT/EAT.☆19Mar 3, 2016Updated 10 years ago
- Reconstruct process trees from event logs☆148Aug 12, 2020Updated 6 years ago
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- EVTXtract recovers and reconstructs fragments of EVTX log files from raw binary data, including unallocated space and memory images.☆213Mar 12, 2025Updated last year
- ☆15Dec 26, 2017Updated 8 years ago
- HTTP/HTTPS/DNS inspector (windows driver)☆25Feb 20, 2019Updated 7 years ago
- ☆28Feb 13, 2017Updated 9 years ago
- 基于WinDivert实现的一个包过滤与截断程序☆13Jul 22, 2018Updated 8 years ago
- windows kernel File redirection☆20Sep 21, 2014Updated 12 years ago
- x64 Kernel Hooks Detection☆21Jan 1, 2017Updated 9 years ago
- WoW64 -> x64☆18Oct 1, 2016Updated 10 years ago
- Limon is a sandbox developed as a research project written in python, which automatically collects, analyzes, and reports on the run time…☆405May 20, 2016Updated 10 years ago
- Virtual machines for every use case on DigitalOcean • AdGet dependable uptime with 99.99% SLA, simple security tools, and predictable monthly pricing with DigitalOcean's virtual machines, called Droplets.
- Detects if a Kernel mode debugger is active by reading the value of KUSER_SHARED_DATA.KdDebuggerEnabled. It is a high level and portable …☆25Sep 18, 2017Updated 9 years ago
- A simple command-line script to interact with the virustotal-api☆61Mar 2, 2018Updated 8 years ago
- Artifact analysis tools by JPCERT/CC Analysis Center☆463Aug 14, 2025Updated last year
- some classes which can help me to program kernel driver in Windows.☆16Feb 9, 2018Updated 8 years ago
- Decompile an x86 exe, and read PE infos.☆19Sep 29, 2018Updated 8 years ago
- IDA反-反调试插件 IDAStealth v1.3.3, created 06/28/2011, Jan Newger☆21Apr 4, 2018Updated 8 years ago
- ETW Python Library☆305Aug 11, 2023Updated 3 years ago
- ☆30May 23, 2017Updated 9 years ago
- ☆14Jun 27, 2017Updated 9 years ago
- Bare Metal GPUs on DigitalOcean Gradient AI • AdPurpose-built for serious AI teams training foundational models, running large-scale inference, and pushing the boundaries of what's possible.
- Kernel Stack info leak at exportObjectToClient function☆40May 21, 2019Updated 7 years ago
- This is a pintool that can analyze target dynamically and output code blocks and "key frames".☆14Mar 26, 2015Updated 11 years ago
- CVE-2017-4878 Samples - http://blog.talosintelligence.com/2018/02/group-123-goes-wild.html☆17Feb 5, 2018Updated 8 years ago
- A minifilter driver preserves all modified and deleted files.☆81Jul 17, 2015Updated 11 years ago
- 驱动层拦截web访问源码☆29Apr 2, 2018Updated 8 years ago
- Scans a list of raccoon servers from Tria.ge and extracts the config☆15Jun 5, 2023Updated 3 years ago
- old code from 2007/2008 which uses split TLB to trace OEP☆16Jun 16, 2018Updated 8 years ago