samshine / ScyllaHideDetector2
Allows you to find the use of ScyllaHide, if your program will debug and restore hooking functions bytes.
☆22Updated 5 years ago
Related projects: ⓘ
- Bypassing kernel patch protection runtime☆19Updated last year
- ZeroImport is a lightweight and easy to use C++ library for Windows Kernel Drivers. It allows you to hide any import in your kernel drive…☆44Updated last year
- POC Hook of nt!HvcallCodeVa☆49Updated last year
- PAGE_GUARD based hooking library☆38Updated 2 years ago
- Intraceptor intercept Windows NT API calls and redirect them to a kernel driver to bypass process/threads handle protections.☆27Updated 2 years ago
- Using SetWindowHookEx for preinjected DLL's☆55Updated 2 years ago
- Скрытие строки от отладчиков и декомпиляторов☆51Updated 4 years ago
- ☆46Updated this week
- ☆31Updated last year
- Hijack NotifyRoutine for a kernelmode thread☆40Updated 2 years ago
- ☆19Updated 7 months ago
- A Hyper-V Hacking Framework For Windows 10 x64 (AMD & Intel)☆29Updated last year
- Bypasses for Windows kernel callbacks PatchGuard protection☆42Updated 3 years ago
- A library with four different methods to execute shellcode in a process☆24Updated 4 years ago
- Compileable POC of namazso's x64 return address spoofer.☆46Updated 4 years ago
- A packed & protected Module Loader and more, for 64-bit Windows☆28Updated 3 years ago
- Win64 UEFI Driver-based tool for unrestricted memory R/W☆24Updated 2 years ago
- Freeze target threads (external - internal ) by avoiding SuspendThread detections. Or access registers from start address.☆29Updated 5 months ago
- Stealthy Injector that leverages a vulnerable driver and other exploits to remain undetected☆36Updated 5 years ago
- A simple direct syscall wrapper written in C++ with compatibility for x86 and x64 programs.☆39Updated last year
- UnknownField is a tool based clang that obfuscating the order of fields to protect your C/C++ game or code.☆44Updated last year
- x64 Windows implementation of virtual-address to physical-address translation☆39Updated 3 years ago
- ☆41Updated this week
- ☆24Updated 3 years ago
- A poc that abuses Enclave☆36Updated 2 years ago
- ☆42Updated 2 years ago
- ☆35Updated 3 years ago
- detect hypervisor with Nmi Callback☆32Updated last year
- silence file system monitoring components by hooking their minifilters☆49Updated 7 months ago
- TS-Changer - Forces the machine in/out of TestSigning Mode at runtime.☆58Updated last year