A tool for detecting manual/direct syscalls in x86 and x64 processes using Nirvana Hooks.
☆118Feb 1, 2022Updated 4 years ago
Alternatives and similar repositories for manual-syscall-detect
Users that are interested in manual-syscall-detect are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- A way to detect DBI frameworks, Debuggers and VMs.☆25Nov 17, 2020Updated 5 years ago
- PoC capable of detecting manual syscalls from usermode.☆211Nov 13, 2025Updated 11 months ago
- ETW based POC to identify direct and indirect syscalls☆197Apr 19, 2023Updated 3 years ago
- FreshyCalls tries to make the use of syscalls comfortable and simple, without generating too much boilerplate and in modern C++17!☆364Sep 1, 2022Updated 4 years ago
- Hellsgate + Halosgate/Tartarosgate. Ensures that all systemcalls go through ntdll.dll☆521Feb 3, 2022Updated 4 years ago
- Managed hosting for WordPress and PHP on Cloudways • AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- Security product hook detection☆324Mar 30, 2021Updated 5 years ago
- Code Injection, Inject malicious payload via pagetables pml4.☆248Jul 7, 2021Updated 5 years ago
- RefleXXion is a utility designed to aid in bypassing user-mode hooks utilised by AV/EPP/EDR etc. In order to bypass the user-mode hooks, …☆497Jan 25, 2022Updated 4 years ago
- Analyze patches in a process☆264Jul 28, 2021Updated 5 years ago
- A simple x86_64 AMD-v hypervisor type-2 Programmed with C++, with soon to be added syscall hooks. [W.I.P]☆114Aug 3, 2023Updated 3 years ago
- Proof-of-Concept software for detecting AV/EDR hooks in Windows libraries.☆40May 12, 2022Updated 4 years ago
- DoppelGate relies on reading ntdll on disk to grab syscall stubs, and patches these syscall stubs into desired functions to bypass Userla…☆122Mar 25, 2022Updated 4 years ago
- A simple program to hook the current process to identify the manual syscall executions on windows☆264Nov 18, 2022Updated 3 years ago
- ☆70Feb 6, 2025Updated last year
- Serverless GPU API endpoints on Runpod - Get Bonus Credits • AdSkip the infrastructure headaches. Auto-scaling, pay-as-you-go, no-ops approach lets you focus on innovating your application.
- Lightweight WINAPI tracing with Pin☆26Aug 22, 2019Updated 7 years ago
- devirtualization vmprotect☆69Mar 11, 2023Updated 3 years ago
- A DTrace on Windows Reimplementation☆379May 28, 2026Updated 5 months ago
- 🪝 Various EPT hook detection approaches☆162Feb 22, 2026Updated 8 months ago
- PoC memory injection detection agent based on ETW, for offensive and defensive research purposes☆300Apr 10, 2021Updated 5 years ago
- ☆27Dec 29, 2021Updated 4 years ago
- Project Ares is a Proof of Concept (PoC) loader written in C/C++ based on the Transacted Hollowing technique☆336Jan 16, 2022Updated 4 years ago
- The Definitive Guide To Process Cloning on Windows☆561Jan 3, 2024Updated 2 years ago
- A proof of concept demonstrating instrumentation callbacks on Windows 10 21h1 with a TLS variable to ensure all syscalls are caught.☆168Nov 14, 2021Updated 4 years ago
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- Recon 2015 Presentation from Alex Ionescu☆253Jan 27, 2016Updated 10 years ago
- x64 Windows kernel code execution via user-mode, arbitrary syscall, vulnerable IOCTLs demonstration☆427Jul 6, 2022Updated 4 years ago
- Inline syscalls made easy for windows on clang☆749Jun 21, 2024Updated 2 years ago
- Hook system calls on Windows by using Kaspersky's hypervisor☆1,325Apr 2, 2026Updated 6 months ago
- A PoC implementation for an evasion technique to terminate the current thread and restore it before resuming execution, while implementin…☆542Aug 1, 2022Updated 4 years ago
- IDA Pro plugin to make bitfield accesses easier to grep☆262Aug 3, 2025Updated last year
- Load any Beacon Object File using Powershell!☆261Dec 9, 2021Updated 4 years ago
- An example code of CiGetCertPublisherName☆15Mar 24, 2022Updated 4 years ago
- WTSRM☆212Aug 7, 2022Updated 4 years ago
- Managed hosting for WordPress and PHP on Cloudways • AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- Some research on AltSystemCallHandlers functionality in Windows 10 20H1 18999☆245Nov 6, 2019Updated 6 years ago
- A variant of Gargoyle for x64 to hide memory artifacts using ROP only and PIC☆374May 24, 2022Updated 4 years ago
- API monitoring via return-hijacking thunks; works without information about target function prototypes.☆119May 26, 2020Updated 6 years ago
- Using Microsoft Warbird to automatically unpack and execute encrypted shellcode in ClipSp.sys without triggering PatchGuard☆271Aug 31, 2022Updated 4 years ago
- ☆507Aug 14, 2022Updated 4 years ago
- ☆61Feb 10, 2022Updated 4 years ago
- base for testing☆201Sep 28, 2024Updated 2 years ago