A comprehensive technical guide with an in-depth analysis of the Windows process lifecycle, from initial user-mode API calls through kernel-mode creation to final user code execution.
☆38Nov 26, 2025Updated 11 months ago
Alternatives and similar repositories for windows-process-lifecycle
Users that are interested in windows-process-lifecycle are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- An MCP server wrapping `kd.exe` for Windows kernel debugging☆17May 13, 2026Updated 5 months ago
- A tool for exploiting Kerberos tickets against system with Credential Guard enabled.☆23Sep 2, 2025Updated last year
- Windows C/C++ development environment on Linux☆18Mar 29, 2026Updated 7 months ago
- Parses logs created by Cobalt Strike, Brute Ratel, OC2 and creates an SQLite DB which can be used to create custom reports.☆32Jul 4, 2026Updated 3 months ago
- A CET-compatible Windows x64 loader that produces fully backed call stacks through runtime function table manipulation, code cave injecti…☆134Sep 6, 2026Updated last month
- End-to-end encrypted cloud storage - Proton Drive • AdSpecial offer: 40% Off Yearly / 80% Off First Month. Protect your most important files, photos, and documents from prying eyes.
- RISC-V VM based shellcode loader PoC - Still WIP☆38Aug 1, 2026Updated 2 months ago
- This repository contains my notes on windows heap internal analysis and exploitation techniques.☆13May 3, 2026Updated 5 months ago
- Silent;Call — Pre-authentication remote root on Cisco CUCM 15.x (CVSS 10.0)☆29Aug 4, 2026Updated 2 months ago
- A workshop about core UDRL mechanics by Joris Ignoul & Mickey De Baets☆24Jun 12, 2026Updated 4 months ago
- Mentally ill EtwTi parser☆74Jan 11, 2026Updated 9 months ago
- C library for Diffie Hellman key exchange with Curve448 und Curve25519. Extracted from OpenSSL.☆11Jan 7, 2021Updated 5 years ago
- Read ETW Provider events. Inspired by ETWExplorer by Pavel Yosifovich☆21Jun 29, 2024Updated 2 years ago
- ☆193Oct 21, 2025Updated last year
- A New Exploitation Technique for Visual Studio Projects☆13Nov 5, 2023Updated 2 years ago
- Open source password manager - Proton Pass • AdSecurely store, share, and autofill your credentials with Proton Pass, the end-to-end encrypted password manager trusted by millions.
- ☆19Jun 10, 2025Updated last year
- HVCI/kCET-aware bugcheck suppressor PoC☆21May 11, 2026Updated 5 months ago
- ☆49Dec 21, 2025Updated 10 months ago
- psexec-like remote execution using the paexec wire protocol that supports paexec and remoteexecm2 from manageengine adselfservice plus☆43Mar 24, 2026Updated 7 months ago
- Beacon Object File (BOF) implementation of the dnscmd.exe functionality used to obtain remote code execution on an ADIDNS server by explo…☆58Jul 8, 2026Updated 3 months ago
- EDRUnChoker - fileless WMI defense that removes EDRChoker QoS throttling policies☆49Jun 8, 2026Updated 4 months ago
- Hybrid Autonomous Logic Operator☆22Oct 9, 2025Updated last year
- stack spoofing☆16Nov 15, 2024Updated last year
- Finding Truth in the Shadows☆126Jan 26, 2023Updated 3 years ago
- Deploy open-source AI quickly and easily - Special Bonus Offer • AdRunpod Hub is built for open source. One-click deployment and autoscaling endpoints without provisioning your own infrastructure.
- Lateral Movement via the .NET Profiler☆99Nov 21, 2024Updated last year
- Busybox-style Beacon Object Files for *nix post-exploitation. Reimplements common Unix utilities as BOFs for use in stripped environments…☆45Jun 14, 2026Updated 4 months ago
- A Beacon Object File (BOF) that performs the complete ESC1 attack chain in a single execution: certificate request with arbitrary SAN (+S…☆119Dec 21, 2025Updated 10 months ago
- A python script to force authentication using MS-RPRN RemoteFindFirstPrinterChangeNotificationEx function (opnum 65).☆31Feb 11, 2025Updated last year
- Transform LDAP filters, BaseDNs, attribute lists, and attribute entries using composable middleware chains. Zero dependencies. Works as a…☆44Apr 13, 2026Updated 6 months ago
- Takes a Windbg dumped structure (using the 'dt' command) and formats it into a C structure☆40Jul 8, 2024Updated 2 years ago
- Stack Spoofing with Synthetic frames based on the work of namazso, SilentMoonWalk, and VulcanRaven☆274Oct 16, 2024Updated 2 years ago
- How to Register your own AV with Defender☆38Aug 27, 2026Updated 2 months ago
- Complete rewrite of the original ioctlance project☆12Sep 5, 2025Updated last year
- Bare Metal GPUs on DigitalOcean Gradient AI • AdPurpose-built for serious AI teams training foundational models, running large-scale inference, and pushing the boundaries of what's possible.
- Sleep Obfuscation via CreateThreadpoolTimer☆24Jul 27, 2026Updated 3 months ago
- Source code on the 1.44MB 3.5 floppy accompanying the Windows NT File System Internals book.☆20Jul 31, 2019Updated 7 years ago
- Blog/Journal on how to backdoor VSCode extensions☆81Feb 24, 2026Updated 8 months ago
- Static analysis & exploitation-triage toolkit for Windows kernel drivers. Discover IOCTLs, Symbolic Links, and check cert , and Downlaods…☆211Apr 27, 2026Updated 6 months ago
- Windows Kernel-Mode Shellcode Development Framework (WKMSDF)☆90Aug 1, 2026Updated 2 months ago
- Abusing exceptions for code execution.☆110Jan 30, 2023Updated 3 years ago
- Detection-aware BloodHound attack-path scoring - the quietest route to your objective, calibrated across five detection tiers (audit/EDR/…☆67Aug 22, 2026Updated 2 months ago