oldboy21 / SyscallMeMaybe
Implementation of Indirect Syscall technique to pop a calc.exe
☆93Updated 9 months ago
Related projects ⓘ
Alternatives and complementary repositories for SyscallMeMaybe
- Code snippets to add on top of cobalt strike sleep mask to achieve patchless hook on AMSI and ETW☆78Updated last year
- TypeLib persistence technique☆75Updated last month
- Improved version of EKKO by @5pider that Encrypts only Image Sections☆113Updated last year
- I have documented all of the AMSI patches that I learned till now☆68Updated last year
- 64-bit, position-independent reverse tcp shell, built in Rust for Windows.☆44Updated last month
- Basic implementation of Cobalt Strikes - User Defined Reflective Loader feature☆95Updated last year
- ☆44Updated 2 years ago
- Simple ETW unhook PoC. Overwrites NtTraceEvent opcode to disable ETW at Nt-function level.☆42Updated 8 months ago
- A basic C2 framework written in C☆58Updated 4 months ago
- ☆62Updated 9 months ago
- It stinks☆100Updated 2 years ago
- ☆96Updated last year
- ApexLdr is a DLL Payload Loader written in C☆105Updated 4 months ago
- Huffman Coding in Shellcode Obfuscation & Dynamic Indirect Syscalls Loader☆85Updated 8 months ago
- Simple POC library to execute arbitrary calls proxying them via NdrServerCall2 or similar☆117Updated 3 months ago
- A Cobalt Strike memory evasion loader for redteamers☆95Updated last year
- Loading Fileless Remote PE from URI to memory with argument passing and ETW patching and NTDLL unhooking and No New Thread technique☆61Updated 2 years ago
- Explorer Persistence technique : Hijacking cscapi.dll order loading path and writing our malicious dll into C:\Windows\cscapi.dll , when …☆75Updated last year
- An implementation of an indirect system call☆116Updated last year
- A PoC of Stack encryption prior to custom sleeping by leveraging CPU cycles.☆55Updated last year
- DLL proxy load example using the Windows thread pool API, I/O completion callback with named pipes, and C++/assembly☆57Updated 8 months ago
- ☆76Updated last year
- Threadless shellcode injection tool☆60Updated 3 months ago
- In-memory sleep encryption and heap encryption for Go applications through a shellcode function.☆39Updated 10 months ago
- Cobalt Strike + Brute Ratel C4 Beacon Object File (BOF) Conversion of the Mockingjay Process Injection Technique☆149Updated last year
- ☆118Updated last year
- This script is used to bypass DLL Hooking using a fresh mapped copy of ntdll file, patch the ETW and trigger a shellcode with process hol…☆67Updated 9 months ago