Inline syscalls made for MSVC supporting x64 and WOW64
☆195Aug 12, 2026Updated 2 months ago
Alternatives and similar repositories for inline-syscall
Users that are interested in inline-syscall are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- This novel way of using NtQueueApcThreadEx by abusing the ApcRoutine and SystemArgument[0-3] parameters by passing a random pop r32; ret …☆266Apr 29, 2023Updated 3 years ago
- Bypassing PatchGuard on modern x64 systems☆268Apr 9, 2023Updated 3 years ago
- Improved version of EKKO by @5pider that Encrypts only Image Sections☆124Feb 13, 2023Updated 3 years ago
- Dont Call Me Back - Dynamic kernel callback resolver. Scan kernel callbacks in your system in a matter of seconds!☆258Jul 9, 2024Updated 2 years ago
- A PoC implementation for dynamically masking call stacks with timers.☆316Feb 13, 2023Updated 3 years ago
- GPU virtual machines on DigitalOcean Gradient AI • AdGet to production fast with high-performance AMD and NVIDIA GPUs you can spin up in seconds. The definition of operational simplicity.
- ☆26Oct 18, 2023Updated 3 years ago
- Create a new thread that will suspend every thread and encrypt its stack, then going to sleep , then decrypt the stacks and resume thread…☆167Aug 2, 2023Updated 3 years ago
- Use hardware breakpoints to spoof the call stack for both syscalls and API calls☆205Jun 6, 2024Updated 2 years ago
- Implementation of an export address table protection mitigation, like Export Address Filtering (EAF)☆114May 21, 2023Updated 3 years ago
- Utilizing hardware breakpoints to evade monitoring by Endpoint Detection and Response platforms☆138Dec 20, 2022Updated 3 years ago
- yet another sleep encryption thing. also used the default github repo name for this one.☆67May 11, 2023Updated 3 years ago
- ☆156May 21, 2024Updated 2 years ago
- Single stub direct and indirect syscalling with runtime SSN resolving for windows.☆142Sep 12, 2022Updated 4 years ago
- Basic implementation of Cobalt Strikes - User Defined Reflective Loader feature☆99Feb 28, 2023Updated 3 years ago
- GPU virtual machines on DigitalOcean Gradient AI • AdGet to production fast with high-performance AMD and NVIDIA GPUs you can spin up in seconds. The definition of operational simplicity.
- Block any Process to open HANDLE to your process , only SYTEM is allowed to open handle to your process ,with that you can avoid remote m…☆172Apr 27, 2023Updated 3 years ago
- x64 binary obfuscator☆2,001Jul 14, 2023Updated 3 years ago
- HyperDeceit is the ultimate all-in-one library that emulates Hyper-V for Windows, giving you the ability to intercept and manipulate oper…☆388Jun 3, 2023Updated 3 years ago
- HWSyscalls is a new method to execute indirect syscalls using HWBP, HalosGate and a synthetic trampoline on kernel32 with HWBP.☆734Jul 19, 2023Updated 3 years ago
- ☆137Aug 6, 2022Updated 4 years ago
- Signtool for expired certificates☆524Jun 10, 2023Updated 3 years ago
- A simple program to hook the current process to identify the manual syscall executions on windows☆264Nov 18, 2022Updated 3 years ago
- Code snippets to add on top of cobalt strike sleepmask kit so that ekko can work in a CFG protected process☆47Mar 15, 2023Updated 3 years ago
- ☆88Apr 1, 2022Updated 4 years ago
- Virtual machines for every use case on DigitalOcean • AdGet dependable uptime with 99.99% SLA, simple security tools, and predictable monthly pricing with DigitalOcean's virtual machines, called Droplets.
- Windows x64 kernel mode rootkit process hollowing POC.☆193Jun 30, 2023Updated 3 years ago
- A mapper that maps shellcode into loaded large page drivers☆374Apr 26, 2022Updated 4 years ago
- This tool will allow you to spoof the return addresses of your functions as well as system functions.☆585Nov 12, 2022Updated 3 years ago
- Performing Indirect Clean Syscalls☆631May 2, 2026Updated 5 months ago
- Demo proof of concept for shadow regions, and implementation of HyperDeceit.☆323May 31, 2023Updated 3 years ago
- A work in progress BOF/COFF loader in Rust☆50Mar 22, 2023Updated 3 years ago
- Code snippets to add on top of cobalt strike sleep mask to achieve patchless hook on AMSI and ETW☆87Mar 19, 2023Updated 3 years ago
- Shellcode Loader with Indirect Dynamic syscall Implementation , shellcode in MAC format, API resolving from PEB, Syscall calll and syscal…☆322Aug 2, 2023Updated 3 years ago
- Loads a signed kernel driver which allows you to map any driver to kernel mode without any traces of the signed / mapped driver.☆421Aug 8, 2021Updated 5 years ago
- AI Agents on DigitalOcean Gradient AI Platform • AdBuild production-ready AI agents using customizable tools or access multiple LLMs through a single endpoint. Create custom knowledge bases or connect external data.
- A small NtCreateUserProcess PoC that spawns a Command prompt.☆106Apr 11, 2026Updated 6 months ago
- Modify managed functions from unmanaged code☆53Feb 1, 2024Updated 2 years ago
- Jormungandr is a kernel implementation of a COFF loader, allowing kernel developers to load and execute their COFFs in the kernel.☆242Sep 26, 2023Updated 3 years ago
- Using Microsoft Warbird to automatically unpack and execute encrypted shellcode in ClipSp.sys without triggering PatchGuard☆271Aug 31, 2022Updated 4 years ago
- idk man this was the default github name☆33Apr 23, 2023Updated 3 years ago
- This script is used to unload PsSetCreateProcessNotifyRoutineEx, PsSetCreateProcessNotifyRoutine, PsSetLoadImageNotifyRoutine and PsSetCr…☆66Feb 11, 2024Updated 2 years ago
- Start with shellcode execution using Windows APIs (high level), move on to native APIs (medium level) and finally to direct syscalls (low…☆146May 6, 2023Updated 3 years ago