NTAPI hook bypass with (semi) legit stack trace
☆18May 9, 2023Updated 3 years ago
Alternatives and similar repositories for SyscallHookBypass
Users that are interested in SyscallHookBypass are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- Indirect Syscall invocation via thread hijacking☆27May 5, 2023Updated 3 years ago
- An x64 binary executing code that's not inside of it.☆17Feb 28, 2023Updated 3 years ago
- PoC arbitrary WPM without a process handle☆19Jul 22, 2023Updated 3 years ago
- This POC provides the possibilty to execute x86 shellcode in form of a .bin file based on x86 inline assembly☆20Apr 17, 2023Updated 3 years ago
- Rendering on external windows via hijacking thread contexts, with notes on ValidateHwnd☆14Jul 9, 2020Updated 6 years ago
- Managed Kubernetes at scale on DigitalOcean • AdDigitalOcean Kubernetes includes the control plane, bandwidth allowance, container registry, automatic updates, and more for free.
- ☆11Feb 12, 2023Updated 3 years ago
- Inject shellcode to process using Windows NTAPI for bypassing EDRs and Antiviruses☆38Dec 9, 2020Updated 5 years ago
- some AV / EDR / analysis studies☆10May 21, 2023Updated 3 years ago
- Hacky code for extracting calls in DLLs by function☆16Jun 3, 2022Updated 4 years ago
- A large collection of blogs 🦐☆14Apr 12, 2025Updated last year
- Shellcode execution via x86 inline assembly based on MSVC syntax☆16Apr 26, 2023Updated 3 years ago
- Transparently call NTAPI via Halo's Gate with indirect syscalls.☆13Apr 26, 2024Updated 2 years ago
- A single byte modification in the kernel memory bypasses and disables all core functions of the AV/EDR security solutions☆18Aug 26, 2025Updated last year
- Splitting and executing shellcode across multiple pages☆102Jun 8, 2023Updated 3 years ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- ☆18Feb 23, 2023Updated 3 years ago
- Win64 UEFI Driver-based tool for unrestricted memory R/W☆31Feb 8, 2022Updated 4 years ago
- BloodyAv is Custom Shell Code loader to Bypass Av and Edr.☆16Mar 21, 2022Updated 4 years ago
- Helper script for identifying bad characters based on (Immunity|edb)'s stack dump☆13Mar 18, 2023Updated 3 years ago
- Instrumenting a binary without source code to bypass anti-debug checks☆41Sep 25, 2021Updated 5 years ago
- C++ Code to Patch AMSI in Remote Processes☆10Mar 11, 2025Updated last year
- silence file system monitoring components by hooking their minifilters☆63Jan 31, 2024Updated 2 years ago
- KernelMode GDI Overlay☆28Aug 15, 2025Updated last year
- 64bit WIndows 10 shellcode dat pops dat calc - Dynamic & Null Free☆63Mar 8, 2023Updated 3 years ago
- Deploy to Railway using AI coding agents - Free Credits Offer • AdUse Claude Code, Codex, OpenCode, and more. Autonomous software development now has the infrastructure to match with Railway.
- Simple Windows shellcode loader with interesting evasion tricks☆15Apr 27, 2025Updated last year
- Enumerating EDR WhiteListed Processes☆12Jan 30, 2025Updated last year
- A newer iteration of TitanLdr with some newer hooks, and design. A generic user defined reflective DLL I built to prove a point to Mudge …☆35Mar 20, 2023Updated 3 years ago
- Bypassing AV, EDR, Application Whitelisting and ASR Rules☆13Apr 18, 2023Updated 3 years ago
- (WIP) A Recursive UDRL leveraging smelly_vx's Feverdream trick.☆19Sep 3, 2025Updated last year
- This code example allows you to create a malware.exe sample that can be run in the context of a system service, and could be used for loc…☆55May 8, 2023Updated 3 years ago
- ☆13Feb 25, 2023Updated 3 years ago
- This project is an EDRSandblast fork, adding some features and custom pieces of code.☆16Jan 10, 2024Updated 2 years ago
- A multi-method internal/external API Hooking library for x86/x86-64 Windows.☆14Jan 2, 2025Updated last year
- Simple, predictable pricing with DigitalOcean hosting • AdAlways know what you'll pay with monthly caps and flat pricing. Enterprise-grade infrastructure trusted by 600k+ customers.
- A kernel exploit leveraging NtUserHardErrorControl to elevate a thread to KernelMode and achieve arbitrary kernel R/W & more.☆60Sep 20, 2022Updated 4 years ago
- Use hardware breakpoints to spoof the call stack for both syscalls and API calls☆205Jun 6, 2024Updated 2 years ago
- ASM Bootkit that patches DSE at boot allowing to load unsigned drivers☆20Aug 24, 2025Updated last year
- A Dropper POC with a focus on aiding in EDR evasion, NTDLL Unhooking followed by loading ntdll in-memory, which is present as shellcode (…☆178Feb 10, 2023Updated 3 years ago
- x64 Assembly HalosGate direct System Caller to evade EDR UserLand hooks☆242Mar 8, 2023Updated 3 years ago
- llvm powered deobfuscation of a vm-based protection☆65Feb 25, 2026Updated 8 months ago
- An example of PE hollowing injection technique☆26Jun 28, 2019Updated 7 years ago