xalicex / Get-DLL-and-Function-Addresses
GetModuleHandle (via PEB) and GetProcAddress (via EAT) like
☆32Updated 2 years ago
Related projects ⓘ
Alternatives and complementary repositories for Get-DLL-and-Function-Addresses
- a stage1 DLL loader with sleep obfuscation☆32Updated last year
- Collect Windows telemetry for Maldev☆57Updated this week
- ☆106Updated last year
- A proof of concept I developed to improve Gargoyle back in 2018 to achieve true memory obfuscation from position independent code☆39Updated 2 months ago
- Piece of code to detect and remove hooks in IAT☆58Updated 2 years ago
- Malware?☆70Updated last month
- ZwProcessHollowing is a x64 process hollowing project which uses direct systemcalls, dll unhooking and RC4 payload decryption☆78Updated last year
- Single stub direct and indirect syscalling with runtime SSN resolving for windows.☆127Updated 2 years ago
- Files for http://blog.deniable.org/posts/windows-callbacks/☆67Updated 2 years ago
- Interceptor is a kernel driver focused on tampering with EDR/AV solutions in kernel space☆120Updated last year
- Patch AMSI and ETW in remote process via direct syscall☆77Updated 2 years ago
- Next gen process injection technique☆42Updated 4 years ago
- ☆40Updated last year
- Red Team Operation's Defense Evasion Technique.☆52Updated 5 months ago
- A improved memory obfuscation primitive using a combination of special and 'normal' Asynchronous Procedural Calls☆104Updated 2 months ago
- Implementation of an export address table protection mitigation, like Export Address Filtering (EAF)☆93Updated last year
- Combining 3 techniques (Threadless Injection + DLL Stomping + Caro-Kann) together to evade MDE.☆38Updated 10 months ago
- Small PoC of using a Microsoft signed executable as a lolbin.☆133Updated last year
- An initial proof of concept of a bootkit based on Cr4sh's DMABackdoorBoot☆59Updated last year
- A newer iteration of TitanLdr with some newer hooks, and design. A generic user defined reflective DLL I built to prove a point to Mudge …☆164Updated last year
- Code used in this post https://captmeelo.com/redteam/maldev/2022/04/21/kernelcallbacktable-injection.html☆99Updated 2 years ago
- Experiment on reproducing Obfuscate & Sleep☆139Updated 3 years ago
- A kernel vulnerability used to achieve arbitrary read-write on Windows prior to July 2022☆105Updated last year
- Template-based generation of shellcode loaders☆67Updated 7 months ago
- A Bumblebee-inspired Crypter☆80Updated last year
- Dirty PoC on how to abuse S1's VEH for Vectored Syscalls and Local Execution☆38Updated 4 months ago
- ☆35Updated last year
- a library that automates some clean syscalls to make it easier to implement☆82Updated 2 years ago
- ☆76Updated 2 months ago
- ☆133Updated last year