tandasat / DotNetHookingLinks
Sample use cases of the .NET native code hooking technique
☆218Updated 7 years ago
Alternatives and similar repositories for DotNetHooking
Users that are interested in DotNetHooking are comparing it to the libraries listed below
Sorting:
- FLARE Kernel Shellcode Loader☆178Updated 6 years ago
- ☆220Updated 7 years ago
- Ruxcon2016 POC Code☆141Updated 9 years ago
- A C/C++ implementation of Microsoft's Antimalware Scan Interface☆182Updated 7 years ago
- Mario & Luigi - Tools for sniffing Windows Named Pipes communication☆129Updated 9 years ago
- PoC for persisting .NET payloads in Windows Notification Facility (WNF) state names using low-level Windows Kernel API calls.☆152Updated 6 years ago
- Tools for instrumenting Windows Defender's mpengine.dll☆309Updated 7 years ago
- A simple utility to list all methods of a given .NET Assembly and to invoke them☆75Updated 4 years ago
- Driver Initial Reconnaissance Tool☆125Updated 6 years ago
- An attempt at Process Doppelgänging☆183Updated 8 years ago
- A proof of concept for dynamically loading .net assemblies at runtime with only a minimal convention pre-knowledge☆164Updated 7 years ago
- This is a simple example and explanation of obfuscating API resolution via hashing☆237Updated 5 years ago
- ☆129Updated 5 years ago
- Demos of various (also non standard) persistence methods used by malware☆223Updated 2 years ago
- ☆234Updated 8 years ago
- This respository is a collection of C# class libraries which implement RPC clients for various versions of the Windows Operating System f…☆283Updated 5 years ago
- Automatically rebuild Import Address Table for dumped PE file. With python bindings!☆121Updated 6 years ago
- Tool to view and create Microsoft shim database files (SDB).☆118Updated 8 years ago
- ☆116Updated 9 years ago
- A tool to exploit .NET DCOM for EoP and RCE. Is fixed in latest versions of the .NET.☆92Updated 11 years ago
- Adds a user-mode asynchronous procedure call (APC) object to the APC queue of the specified thread and spoof the Parent Process.☆158Updated 6 years ago
- Process reimaging proof of concept code☆97Updated 6 years ago
- Enumerate Windows Defender threat families and dump their names according category☆93Updated 6 years ago
- Load a Windows Kernel Driver☆94Updated 8 years ago
- Zerokit/GAPZ rootkit (non buildable and only for researching)☆185Updated 6 years ago
- Two IDAPython Scripts help you to reconstruct Microsoft COM (Component Object Model) Code☆184Updated 5 years ago
- My repository to upload drivers from different books and all the information related to windows internals.☆163Updated 6 years ago
- Process Doppelgänging☆162Updated 8 years ago
- Pocs for Antivirus Software‘s Kernel Vulnerabilities☆264Updated 8 years ago
- Script analysis tool based on Frida.re☆130Updated 8 years ago