mrexodia / AppInitHookLinks
Global user-mode hooking framework, based on AppInit_DLLs. The goal is to allow you to rapidly develop hooks to inject in an arbitrary process.
☆172Updated 3 years ago
Alternatives and similar repositories for AppInitHook
Users that are interested in AppInitHook are comparing it to the libraries listed below
Sorting:
- Analyze patches in a process☆254Updated 3 years ago
- IDA Pro plugin to make bitfield accesses easier to grep☆239Updated 4 months ago
- Resolve DOS MZ executable symbols at runtime☆95Updated 3 years ago
- Using Microsoft Warbird to automatically unpack and execute encrypted shellcode in ClipSp.sys without triggering PatchGuard☆248Updated 2 years ago
- Bootkit for Windows Sandbox to disable DSE/PatchGuard.☆289Updated 8 months ago
- A modern c++ implementation of windows heavens gate☆224Updated 4 years ago
- codes for my blog post: https://secrary.com/Random/InstrumentationCallback/☆177Updated 7 years ago
- Debugger Anti-Detection Benchmark☆334Updated last year
- Some research on AltSystemCallHandlers functionality in Windows 10 20H1 18999☆219Updated 5 years ago
- Advanced driver monitoring utility.☆212Updated 2 years ago
- x64 Windows kernel code execution via user-mode, arbitrary syscall, vulnerable IOCTLs demonstration☆330Updated 2 years ago
- Browse Page Tables on Windows (Page Table Viewer)☆210Updated 3 years ago
- APC Internals Research Code☆166Updated 4 years ago
- C++ library for parsing and manipulating PE files statically and dynamically.☆88Updated last year
- A ProcMon-esque tool for monitoring Windows Kernel Drivers☆58Updated 4 years ago
- Research on Windows Kernel Executive Callback Objects☆288Updated 5 years ago
- Universal x86/x64 VMProtect 2.0-3.X Import fixer☆7Updated 3 years ago
- Translates WinDbg "dt" structure dump to a C structure☆128Updated 8 years ago
- ShowStopper is a tool for helping malware researchers explore and test anti-debug techniques or verify debugger plugins or other solution…☆206Updated 2 years ago
- compile-time control flow obfuscation using mba☆184Updated last year
- COFF and Portable Executable format described using standard C++ with no dependencies.☆318Updated 2 months ago
- x64 Windows PatchGuard bypass, register process-creation callbacks from unsigned code☆204Updated 4 years ago
- Kernel LdrLoadDll injector☆260Updated 6 years ago
- Ghetto user mode emulation of Windows kernel drivers.☆140Updated 8 months ago
- Hex-Rays microcode plugin for automated simplification of Windows Kernel decompilation.☆603Updated 4 months ago
- This project provides a collection of Microsoft Windows kernel structures, unions and enumerations. Most of them are not officially docum…☆207Updated 4 months ago
- Header only wrapper around Hex-Rays API in C++20.☆159Updated 6 months ago
- A proof of concept demonstrating instrumentation callbacks on Windows 10 21h1 with a TLS variable to ensure all syscalls are caught.☆136Updated 3 years ago
- IDA Plugin that fills in missing indirect CALL & JMP target information☆128Updated 5 months ago
- Converted phnt (Native API header files from the System Informer project) to IDA TIL, IDC (Hex-Rays).☆143Updated 10 months ago