nqntmqmqmb / xorPacker
A simple packer working with all PE files which cipher your exe with a XOR implementation
☆14Updated 4 years ago
Alternatives and similar repositories for xorPacker:
Users that are interested in xorPacker are comparing it to the libraries listed below
- Another Portable Executable files analysing stuff☆20Updated 13 years ago
- Listing UDP connections with remote address without sniffing.☆30Updated last year
- Process Hollowing POC in CPP☆15Updated 4 years ago
- ☆12Updated 4 years ago
- really ?☆12Updated last year
- ☆25Updated last week
- Create a C++ PE which loads an XTEA-crypted .NET PE shellcode in memory.☆16Updated 6 years ago
- Remote PE reflective injection with a simple reflective loader☆31Updated 5 years ago
- ☆16Updated 3 years ago
- A repository filled with ideas to break/detect direct syscall techniques☆27Updated 2 years ago
- A PoC to demo modifying cmdline of the child process dynamically. It might be useful against process log tracing, AV or EDR.☆38Updated 4 years ago
- Malware persistence via COM DLL hijacking. C++ implementation example☆13Updated 2 years ago
- A PoC tool for exploiting leaked process and thread handles☆30Updated last year
- Manually perform syscalls without going through any external API or DLL.☆18Updated last year
- A class to emulate the behavior of NtQuerySystemInformation when passed the SystemHypervisorDetailInformation information class☆26Updated last year
- Herpaderply Hollowing - a PE injection technique, hybrid between Process Hollowing and Process Herpaderping☆52Updated 2 years ago
- using the Recycle Bin to insure persistence☆12Updated 2 years ago
- Bypass UAC at any level by abusing the Task Scheduler and environment variables☆31Updated 3 years ago
- This POC provides the possibilty to execute x86 shellcode in form of a .bin file based on x86 inline assembly☆18Updated last year
- A simple PE loader.☆26Updated 2 years ago
- Remove API hooks from a Beacon process.☆13Updated 3 years ago
- A Practical example of ELAM (Early Launch Anti-Malware)☆32Updated 3 years ago
- Clone running process with ZwCreateProcess☆57Updated 4 years ago
- Six cases demonstrating methods of optimizing GetProcAddress☆17Updated 3 years ago
- Evilbytecode-Gate resolves Windows System Service Numbers (SSNs) using two methods: analyzing the Guard CF Table in ntdll.dll and parsing…☆18Updated 3 weeks ago
- 💻 Windows 10 Kernel-mode rootkit☆31Updated 2 years ago
- Collection of shellcode injection and execution techniques☆16Updated 3 years ago
- Read ETW Provider events. Inspired by ETWExplorer by Pavel Yosifovich☆14Updated 8 months ago
- C code to enable ETW tracing for Dotnet Assemblies☆31Updated 2 years ago
- PoC for DEF CON 26: Playing Malware Injection with Exploit thoughts☆23Updated 6 years ago