Alternatives and similar repositories for direct-syscall:

Users that are interested in direct-syscall are comparing it to the libraries listed below

• zimnyaa / insomnia
  a stage1 DLL loader with sleep obfuscation
  ☆33Updated 2 years ago
• RobinFassinaMoschiniForks / TransitionalPeriod
  Former Multi - Ring to Kernel To UserMode Transitional Shellcode For Remote Kernel Exploits
  ☆28Updated 2 years ago
• LloydLabs / process-enumeration-stealth
  ☆79Updated 4 months ago
• LloydLabs / dearg-thread-ipc-stealth
  A novel technique to communicate between threads using the standard ETHREAD structure
  ☆111Updated 3 years ago
• xalicex / Get-DLL-and-Function-Addresses
  GetModuleHandle (via PEB) and GetProcAddress (via EAT) like
  ☆32Updated 2 years ago
• xalicex / Unhook-Import-Address-Table
  Piece of code to detect and remove hooks in IAT
  ☆62Updated 2 years ago
• lem0nSec / Dsebler
  Reimplementation of the KExecDD DSE bypass technique.
  ☆46Updated 4 months ago
• knight0x07 / BumbleCrypt
  A Bumblebee-inspired Crypter
  ☆80Updated 2 years ago
• passthehashbrowns / suspendedunhook
  ☆37Updated 3 years ago
• dobin / ace-firefist
  Attack chain emulator. Write recipes for initial access easily
  ☆20Updated last year
• SECFORCE / SharpASM
  SharpASM is a C# project that aims to automate ASM (i.e. shellcode) execution in .NET programs by exploiting code caves in RWX sections a…
  ☆57Updated 2 years ago
• crummie5 / Freshycalls_PoC
  A simple dumper as FreshyCalls' PoC. That's what's trendy, isn't it? ¯\_(ツ)_/¯
  ☆39Updated 4 years ago
• SolomonSklash / UnhookingPOC
  A small commented POC for removing API hooks placed by AV/EDR.
  ☆33Updated 4 years ago
• realoriginal / foliage
  A proof of concept I developed to improve Gargoyle back in 2018 to achieve true memory obfuscation from position independent code
  ☆40Updated 4 months ago
• rad9800 / VehApiResolve
  ☆105Updated 2 years ago
• Reijaff / offensive_c
  ☆41Updated 2 years ago
• maziland / StackBombing
  Next gen process injection technique
  ☆43Updated 4 years ago
• fern89 / runpe-x64
  RunPE adapted for x64 and written in C, does not use RWX
  ☆24Updated 8 months ago
• susMdT / effective-waffle
  yet another sleep encryption thing. also used the default github repo name for this one.
  ☆69Updated last year
• thefLink / Hunt-Weird-ImageLoads
  Small tool to play with IOCs caused by Imageload events
  ☆42Updated last year
• Octoberfest7 / Proxy_Egress_Persistence
  A post-exploitation strategy for persistence and egress from networks utilizing authenticated web proxies
  ☆32Updated 2 years ago
• yamakadi / ldr
  A work in progress BOF/COFF loader in Rust
  ☆46Updated last year
• ethereal-vx / Persistence
  Recreating and reviewing the Windows persistence methods
  ☆39Updated 3 years ago
• SolomonSklash / COM-Hijacking
  An example of COM hijacking using a proxy DLL.
  ☆25Updated 3 years ago
• janoglezcampos / c_syscalls
  Single stub direct and indirect syscalling with runtime SSN resolving for windows.
  ☆132Updated 2 years ago
• matterpreter / cpuid
  A class to emulate the behavior of NtQuerySystemInformation when passed the SystemHypervisorDetailInformation information class
  ☆24Updated last year
• caueb / ThreadlessStompingKann
  Combining 3 techniques (Threadless Injection + DLL Stomping + Caro-Kann) together to evade MDE.
  ☆38Updated last year
• rbmm / NtDetours
  Detours implementation (x64/x86) which used only ntdll import
  ☆88Updated 7 months ago