Alternatives and similar repositories for rootkit-arsenal-guacamole

Users that are interested in rootkit-arsenal-guacamole are comparing it to the libraries listed below

• therealdreg / cgaty

  View on GitHub
  Hooking the GDT - Installing a Call Gate. POC for Rootkit Arsenal Book Second Edition (version 2022)
  ☆73Aug 11, 2023Updated 2 years ago
• zodiacon / Minimal

  View on GitHub
  ☆20Mar 15, 2023Updated 2 years ago
• txsniper / Rootkit-Arsenal

  View on GitHub
  Rootkit Arsenal 2nd Source Code
  ☆15Aug 6, 2013Updated 12 years ago
• 0xcpu / WinAltSyscallHandler

  View on GitHub
  Some research on AltSystemCallHandlers functionality in Windows 10 20H1 18999
  ☆239Nov 6, 2019Updated 6 years ago
• EBalloon / MmCopyMemory

  View on GitHub
  ☆23May 17, 2022Updated 3 years ago
• bananabr / Givemeahand

  View on GitHub
  A PoC tool for exploiting leaked process and thread handles
  ☆32Feb 13, 2024Updated 2 years ago
• rad9800 / VehApiResolve

  View on GitHub
  ☆118Aug 7, 2022Updated 3 years ago
• WithSecureLabs / ModuleStomping

  View on GitHub
  https://blog.f-secure.com/hiding-malicious-code-with-module-stomping/
  ☆126Sep 19, 2019Updated 6 years ago
• am0nsec / vxlib

  View on GitHub
  C Header Only Library for Virii
  ☆12Nov 17, 2020Updated 5 years ago
• OrShazam / ChainEngine

  View on GitHub
  automates exploits using ROP chains, using ntdll-scraper
  ☆16May 26, 2022Updated 3 years ago
• paranoidninja / 0xdarkvortex-red-team-ttps-part-2

  View on GitHub
  Code for blog written at 0xdarkvortex.dev Red Team TTPs Part 2
  ☆19Oct 8, 2020Updated 5 years ago
• Sentient111 / ClearDriverTraces

  View on GitHub
  clearing traces of a loaded driver
  ☆47Jul 2, 2022Updated 3 years ago
• kkent030315 / EvilHooker

  View on GitHub
  Function hooks in Windows NT Kernel
  ☆27Oct 13, 2020Updated 5 years ago
• alfarom256 / UserVAtoPhysical

  View on GitHub
  Walks the Process' VAD list to grab the PTE's corresponding to a usermode virtual address, all to get the physical address
  ☆23Nov 22, 2021Updated 4 years ago
• waleedassar / RestrictedKernelLeaks

  View on GitHub
  ☆163Sep 18, 2021Updated 4 years ago
• yardenshafir / DpcWait

  View on GitHub
  Driver demonstrating how to register a DPC to asynchronously wait on an object
  ☆50Jan 15, 2021Updated 5 years ago
• joe-desimone / patriot

  View on GitHub
  ☆153Jul 31, 2022Updated 3 years ago
• veryboreddd / Return-address-spoofer

  View on GitHub
  Illustrates the concept of return address spoofing, and how it is used.
  ☆14May 13, 2020Updated 5 years ago
• alfarom256 / MinifilterResearch

  View on GitHub
  ☆16Oct 31, 2022Updated 3 years ago
• Peribunt / Exception-Ret-Spoofing

  View on GitHub
  A simple way to spoof return addresses using an exception handler
  ☆43Aug 3, 2022Updated 3 years ago
• nccgroup / DetectWindowsCopyOnWriteForAPI

  View on GitHub
  Enumerate various traits from Windows processes as an aid to threat hunting
  ☆202Jan 13, 2022Updated 4 years ago
• redplait / pexphide

  View on GitHub
  PoC for hiding PE exports
  ☆67Dec 19, 2020Updated 5 years ago
• d35ha / DumpPE

  View on GitHub
  Dump mapped PE files from memory to the disk
  ☆20Jun 28, 2019Updated 6 years ago
• Kr0ff / WinMalDev

  View on GitHub
  Various methods of executing shellcode
  ☆74Mar 27, 2023Updated 2 years ago
• waleedassar / ALPC_CLIENT_SERVER

  View on GitHub
  Demo to show how write ALPC Client & Server using native Ntdll.dll syscalls.
  ☆21Jan 25, 2022Updated 4 years ago
• waleedassar / SyscallNumberExtractor

  View on GitHub
  ☆24Sep 26, 2021Updated 4 years ago
• blaquee / APCHook

  View on GitHub
  hooking KiUserApcDispatcher
  ☆25Apr 3, 2017Updated 8 years ago
• hasherezade / module_overloading

  View on GitHub
  A more stealthy variant of "DLL hollowing"
  ☆363Mar 8, 2024Updated last year
• am0nsec / vx

  View on GitHub
  Virus Exchange (VX) - Collection of malware or assembly code used for "offensive" purposed.
  ☆192Aug 3, 2025Updated 6 months ago
• y11en / lm_tools

  View on GitHub
  横向移动三剑客 ( Lateral movement tools)
  ☆30Nov 16, 2021Updated 4 years ago
• hasherezade / transacted_hollowing

  View on GitHub
  Transacted Hollowing - a PE injection technique, hybrid between ProcessHollowing and ProcessDoppelgänging
  ☆581Mar 8, 2024Updated last year
• n4r1b / WdFilter-Research

  View on GitHub
  Data and structures regarding the research done on WdFilter
  ☆12Apr 15, 2020Updated 5 years ago
• connormcgarr / Shellcode

  View on GitHub
  Various shellcodes
  ☆13Sep 1, 2020Updated 5 years ago
• adrianyy / nasm_shellcode

  View on GitHub
  NASM listing to shellcode converter
  ☆14May 6, 2018Updated 7 years ago
• Meowoverflow / Rootkits_Subverting_the_Windows_Kernel

  View on GitHub
  source code for the examples and topics from the book
  ☆10Mar 11, 2019Updated 6 years ago
• huoji120 / mash_hypervisor

  View on GitHub
  mash hypervisor host pml4
  ☆17Jun 22, 2022Updated 3 years ago
• SHA-MRIZ / FsMinfilterHooking

  View on GitHub
  ☆33Dec 22, 2020Updated 5 years ago
• Shhoya / Shh0yaKernelHook

  View on GitHub
  Shh0ya Kernel Hook Driver
  ☆25Dec 8, 2020Updated 5 years ago
• hasherezade / process_overwriting

  View on GitHub
  Yet another variant of Process Hollowing
  ☆426Jul 31, 2025Updated 6 months ago