nnot09 / direct-syscall
A simple example on how to initiate a direct syscall on WoW64
☆11Updated 7 years ago
Alternatives and similar repositories for direct-syscall:
Users that are interested in direct-syscall are comparing it to the libraries listed below
- ☆80Updated 5 months ago
- a stage1 DLL loader with sleep obfuscation☆35Updated 2 years ago
- A Bumblebee-inspired Crypter☆80Updated 2 years ago
- Former Multi - Ring to Kernel To UserMode Transitional Shellcode For Remote Kernel Exploits☆27Updated 2 years ago
- GetModuleHandle (via PEB) and GetProcAddress (via EAT) like☆32Updated 3 years ago
- A novel technique to communicate between threads using the standard ETHREAD structure☆110Updated 3 years ago
- ☆37Updated 3 years ago
- Piece of code to detect and remove hooks in IAT☆62Updated 2 years ago
- Read ETW Provider events. Inspired by ETWExplorer by Pavel Yosifovich☆14Updated 7 months ago
- Next gen process injection technique☆44Updated 4 years ago
- A small commented POC for removing API hooks placed by AV/EDR.☆33Updated 4 years ago
- A simple dumper as FreshyCalls' PoC. That's what's trendy, isn't it? ¯\_(ツ)_/¯☆40Updated 4 years ago
- Small tool to play with IOCs caused by Imageload events☆42Updated last year
- ☆106Updated 2 years ago
- A simple Linux in-memory .so loader☆29Updated last year
- RunPE adapted for x64 and written in C, does not use RWX☆23Updated 9 months ago
- A C port of b33f's UrbanBishop☆38Updated 4 years ago
- yet another sleep encryption thing. also used the default github repo name for this one.☆70Updated last year
- A python polymorphic engine for C programs☆12Updated last year
- SharpASM is a C# project that aims to automate ASM (i.e. shellcode) execution in .NET programs by exploiting code caves in RWX sections a…☆57Updated 2 years ago
- A tool for detecting manual/direct syscalls in x86 and x64 processes using Nirvana Hooks.☆107Updated 3 years ago
- Implementation of an export address table protection mitigation, like Export Address Filtering (EAF)☆96Updated last year
- Hacky code for extracting calls in DLLs by function☆14Updated 2 years ago
- ☆14Updated 2 years ago
- Process Injection: APC Injection☆29Updated 4 years ago
- A work in progress BOF/COFF loader in Rust☆47Updated last year
- A multi-staged malware that contains a kernel mode rootkit and a remote system shell.☆72Updated 3 years ago
- Reimplementation of the KExecDD DSE bypass technique.☆46Updated 5 months ago
- ☆28Updated 3 years ago
- A repository filled with ideas to break/detect direct syscall techniques☆27Updated 2 years ago