nsacyber / Driver-ColliderLinks
Blocks drivers from loading by using a name collision technique. #nsacyber
☆49Updated 8 years ago
Alternatives and similar repositories for Driver-Collider
Users that are interested in Driver-Collider are comparing it to the libraries listed below
Sorting:
- Windows Drivers☆100Updated 6 years ago
- CallMon is an experimental system call monitoring tool that works on Windows 10 versions 2004+ using PsAltSystemCallHandlers☆145Updated 5 years ago
- A tool to help malware analysts tell that the sample is injecting code into other process.☆78Updated 10 years ago
- WNF Utilities 4 Newbies (WNFUN)☆100Updated 7 years ago
- A process overwriting its own PEB to make an illusion that it has been loaded from a different path.☆99Updated 4 years ago
- Demos and presentation from SECArmy Village Grayhat 2020☆37Updated 2 years ago
- Enumerate user mode shared memory mappings on Windows.☆126Updated 4 years ago
- PoC designed to evade userland-hooking anti-virus.☆90Updated 6 years ago
- Sysmon shenanigans☆66Updated 5 years ago
- An experimental dynamic malware unpacker based on Intel Pin and PE-sieve☆63Updated last year
- Adding exceptions to Microsoft's Control Flow Guard (CFG)☆57Updated 9 years ago
- A small library helping to parse commandline parameters (for C/C++)☆58Updated 8 months ago
- Parser for a custom executable formats from Hidden Bee and Rhadamanthys malware☆58Updated 6 months ago
- Hidden kernel mode code execution for bypassing modern anti-rootkits.☆84Updated 15 years ago
- ☆65Updated 2 years ago
- r0ak ("roak") is the Ring 0 Army Knife -- A Command Line Utility To Read/Write/Execute Ring Zero on for Windows 10 Systems☆28Updated 7 years ago
- Enumerate Windows Defender threat families and dump their names according category☆93Updated 6 years ago
- Blog posts☆29Updated 5 years ago
- PoC for detecting and dumping process hollowing code injection☆52Updated 7 years ago
- Protects deletion of files with a specified extension using a kernel-mode driver.☆76Updated 7 years ago
- Driver Initial Reconnaissance Tool☆126Updated 6 years ago
- PoC for detecting and dumping code injection (built and extended on UnRunPE)☆58Updated 7 years ago
- ☆23Updated 5 years ago
- ☆29Updated 7 years ago
- ☆34Updated 8 years ago
- A set of small utilities, helpers for PIN tracers☆36Updated 4 months ago
- This tool is the result of a reverse engineering process of the Windows service called SysMain. Time to interact with the prefetch files …☆32Updated 5 years ago
- Miscellaneous Code and Docs☆84Updated 6 months ago
- Archive of ransomware decryptors☆34Updated 8 years ago
- ☆34Updated 7 years ago