trailofbits / RpcInvestigatorLinks
Exploring RPC interfaces on Windows
☆330Updated last year
Alternatives and similar repositories for RpcInvestigator
Users that are interested in RpcInvestigator are comparing it to the libraries listed below
Sorting:
- RPC Monitor tool based on Event Tracing for Windows☆372Updated last year
- Tools and PoCs for Windows syscall investigation.☆361Updated 3 months ago
- Sysmon-Like research tool for ETW☆364Updated 2 years ago
- Leaked Windows processes handles identification tool☆290Updated 3 years ago
- Tools and technical write-ups describing attacking techniques that rely on concealing code execution on Windows☆217Updated 3 years ago
- ☆223Updated 3 years ago
- SHAREM is a shellcode analysis framework, capable of emulating more than 20,000 WinAPIs and virutally all Windows syscalls. It also conta…☆417Updated 2 months ago
- Expriments☆467Updated 11 months ago
- ROP ROCKET is an advanced code-reuse attack framework, with extensive ROP chain generation capabilities, including for novel Windows Sysc…☆154Updated last month
- Vulnerable driver research tool, result and exploit PoCs☆214Updated last year
- C# Utilities for Windows Notification Facility☆158Updated 5 months ago
- Combining Sealighter with unpatched exploits to run the Threat-Intelligence ETW Provider☆189Updated 2 years ago
- A PoC of the ContainYourself research presented in DEFCON 31, which abuses the Windows containers framework to bypass EDRs.☆317Updated 2 years ago
- MSI Dump - a tool that analyzes malicious MSI installation packages, extracts files, streams, binary data and incorporates YARA scanner.☆217Updated 2 years ago
- ☆96Updated 3 years ago
- Enumerating and removing kernel callbacks using signed vulnerable drivers☆575Updated 2 years ago
- Kernel Exploits☆258Updated 4 years ago
- Bring your own print driver privilege escalation tool☆257Updated 4 years ago
- Weaponizing to get NT SYSTEM for Privileged Directory Creation Bugs with Windows Error Reporting☆358Updated 2 years ago
- A variant of Gargoyle for x64 to hide memory artifacts using ROP only and PIC☆368Updated 3 years ago
- Dump the memory of any PPL with a Userland exploit chain☆343Updated 2 years ago
- Yet another variant of Process Hollowing☆417Updated last month
- Leverage AMSI (Antimalware Scan Interface) technology to aid your analysis. This tool saves all buffers (scripts, .NET assemblies, etc) …☆111Updated 4 years ago
- ☆184Updated 3 years ago
- ShellWasp is a tool to help build shellcode that utilizes Windows syscalls, while overcoming the portability problem associated with Wind…☆170Updated 2 years ago
- Find patterns of vulnerabilities on Windows in order to find 0-day and write exploits of 1-days. We use Microsoft security updates in ord…☆188Updated 4 years ago
- ☆105Updated last year
- Jormungandr is a kernel implementation of a COFF loader, allowing kernel developers to load and execute their COFFs in the kernel.☆240Updated last year
- A small program written in C that is designed to load 32/64-bit shellcode and allow for execution or debugging. Can also output PE files …☆160Updated last year
- FreshyCalls tries to make the use of syscalls comfortable and simple, without generating too much boilerplate and in modern C++17!☆342Updated 3 years ago