xsh3llsh0ck / PicoHook
Small driver that uses alternative syscalls feature (the project is still under development).
☆15Updated 9 months ago
Alternatives and similar repositories for PicoHook:
Users that are interested in PicoHook are comparing it to the libraries listed below
- PAGE_GUARD based hooking library☆42Updated 2 years ago
- ntoskrnl .data hooks for UM-KM communication☆36Updated 8 months ago
- ☆28Updated 4 months ago
- ZeroImport is a lightweight and easy to use C++ library for Windows Kernel Drivers. It allows you to hide any import in your kernel drive…☆48Updated last year
- A poc that abuses Enclave☆36Updated 2 years ago
- POC Hook of nt!HvcallCodeVa☆49Updated last year
- partially disable patchguard up to win11 21H2☆18Updated 8 months ago
- Tool to dump EFI runtime drivers.☆35Updated 11 months ago
- Using c++23 compile-time magic to produce obfuscated PIC strings and arrays.☆17Updated 8 months ago
- Allows for same-file KernelMode function execution using Encrypted addresses of Functions☆28Updated 4 months ago
- detect hypervisor with Nmi Callback☆34Updated 2 years ago
- Create stealthy, inline, EPT-like hooks using SMAP and SMEP☆36Updated 4 months ago
- Hijack NotifyRoutine for a kernelmode thread☆41Updated 2 years ago
- Patches DSE by swapping both data ptrs located in SeValidateImageHeader && SeValidateImageData☆19Updated last year
- Compileable POC of namazso's x64 return address spoofer.☆51Updated 4 years ago
- search for a driver/dll module that has a wanted section bigger than the size of your image☆20Updated 3 years ago
- Achieving code execution through abusing vectored exception handling☆17Updated last year
- Driver that communicates using a thread and a shared section with Usermode☆38Updated last week
- UnknownField is a tool based clang that obfuscating the order of fields to protect your C/C++ game or code.☆44Updated 2 years ago
- ☆30Updated last year
- Freeze target threads (external - internal ) by avoiding SuspendThread detections. Or access registers from start address.☆30Updated 10 months ago
- ☆20Updated 3 years ago
- Bypassing kernel patch protection runtime☆19Updated 2 years ago
- EFI bootkit for loading unsigned drivers☆17Updated 7 months ago
- This is a POC Test project for INTEL CPUs on blocking NMI Entries through the IDT Handler.☆35Updated 4 months ago
- Experiment with PAGE_GUARD protection to hide memory from other processes☆45Updated 7 months ago
- C/C++ antidebugging library for Windows☆17Updated last month
- ☆18Updated 2 years ago
- Old way for blocking NMI interrupts☆25Updated 2 years ago
- Kernel Level NMI Callback Blocker☆64Updated 5 months ago