trailofbits / RpcInvestigatorLinks
Exploring RPC interfaces on Windows
☆330Updated last year
Alternatives and similar repositories for RpcInvestigator
Users that are interested in RpcInvestigator are comparing it to the libraries listed below
Sorting:
- Tools and PoCs for Windows syscall investigation.☆362Updated 3 months ago
- RPC Monitor tool based on Event Tracing for Windows☆372Updated last year
- Sysmon-Like research tool for ETW☆365Updated 2 years ago
- Leaked Windows processes handles identification tool☆288Updated 3 years ago
- Tools and technical write-ups describing attacking techniques that rely on concealing code execution on Windows☆217Updated 3 years ago
- ☆222Updated 3 years ago
- Expriments☆468Updated last year
- Bring your own print driver privilege escalation tool☆258Updated 4 years ago
- A variant of Gargoyle for x64 to hide memory artifacts using ROP only and PIC☆368Updated 3 years ago
- A PoC of the ContainYourself research presented in DEFCON 31, which abuses the Windows containers framework to bypass EDRs.☆317Updated 2 years ago
- C# Utilities for Windows Notification Facility☆159Updated 5 months ago
- ☆492Updated 3 years ago
- Yet another variant of Process Hollowing☆419Updated 2 months ago
- Combining Sealighter with unpatched exploits to run the Threat-Intelligence ETW Provider☆190Updated 2 years ago
- SHAREM is a shellcode analysis framework, capable of emulating more than 20,000 WinAPIs and virutally all Windows syscalls. It also conta…☆420Updated 3 months ago
- FreshyCalls tries to make the use of syscalls comfortable and simple, without generating too much boilerplate and in modern C++17!☆344Updated 3 years ago
- ROP ROCKET is an advanced code-reuse attack framework, with extensive ROP chain generation capabilities, including for novel Windows Sysc…☆159Updated last week
- ShellWasp is a tool to help build shellcode that utilizes Windows syscalls, while overcoming the portability problem associated with Wind…☆170Updated 2 years ago
- Enumerating and removing kernel callbacks using signed vulnerable drivers☆581Updated 2 years ago
- Dump the memory of any PPL with a Userland exploit chain☆343Updated 2 years ago
- Vulnerable driver research tool, result and exploit PoCs☆217Updated last year
- Leverage AMSI (Antimalware Scan Interface) technology to aid your analysis. This tool saves all buffers (scripts, .NET assemblies, etc) …☆112Updated 4 years ago
- Weaponizing to get NT SYSTEM for Privileged Directory Creation Bugs with Windows Error Reporting☆359Updated 2 years ago
- ☆184Updated 3 years ago
- This novel way of using NtQueueApcThreadEx by abusing the ApcRoutine and SystemArgument[0-3] parameters by passing a random pop r32; ret …☆254Updated 2 years ago
- ☆300Updated 4 years ago
- Jormungandr is a kernel implementation of a COFF loader, allowing kernel developers to load and execute their COFFs in the kernel.☆239Updated 2 years ago
- Windows System Programming Experiments☆221Updated 3 years ago
- Find patterns of vulnerabilities on Windows in order to find 0-day and write exploits of 1-days. We use Microsoft security updates in ord…☆189Updated 4 years ago
- ☆105Updated last year