ZwSalvation

KeygenMe

An RSA + HWID based license system intended to test the skills of crackers, uses memory CRC amongst other anti-debugging and anti-tamper techniques

mitimon

Monitor ETW events for Windows process mitigation policies, with stack traces

drakvuf-sandbox

DRAKVUF Sandbox - automated hypervisor-level malware analysis system

PPLGuard

ordered-map

C++ hash map and hash set which preserve the order of insertion

filesystem

An implementation of C++17 std::filesystem for C++11 /C++14/C++17/C++20 on Windows, macOS, Linux and FreeBSD.

crtsys

C/C++ Runtime library for system file (Windows Kernel Driver) - Supports Microsoft STL

VmwareHardenedLoader

Vmware Hardened VM detection mitigation loader (anti anti-vm)

Windows10-CustomKernelSigners

Load self-signed drivers without TestSigning or disable DSE. Transferred from https://github.com/DoubleLabyrinth/Windows10-CustomKernelSigners

ssde

SSDE is a collection of utilities that help in having Windows load your custom signed kernel drivers when Secure Boot is on and you own the system's platform key, instead of using test mode.

NoScreen

Hiding the window from screenshots using the function win32kfull::ChangeWindowTreeProtection

VTableKFunctionHook

This project will give you an example how you can hook a kernel vtable function that cannot be directly called

WRK

KasperskyHook

Hook system calls on Windows by using Kaspersky's hypervisor

windows-pe-signature-verifying

Modern C++ wrapper for Windows PE signature verification mechanism

Awesome-Binary-Similarity

An awesome & curated list of binary code similarity papers

Awesome-Binary-Rewriting

An awesome & curated list of binary rewriting papers

PE-Parser-MASM32

A PE32/PE32+ parser written in MASM32

Hook_API

Assembly block for hooking windows API functions.

Homework-of-C-Language

C/C++ code examples of my blog.

ProcessDoppelganging

Process doppelganging POC using direct system calls, PPID spoofing and dropbox as an external delivery channel for the payload.

ditto

A tool for IDN homograph attacks and detection.

Mapping-Injection

Just another Windows Process Injection

ByePg

Defeating Patchguard universally for Windows 8, Windows 8.1 and all versions of Windows 10 regardless of HVCI.

injdrv

proof-of-concept Windows Driver for injecting DLL into user-mode processes using APC

Dynlec

Dynamic encrypted loading of DLL's

SysWhispers2

AV/EDR evasion via direct system calls.

BOFs

Collection of Beacon Object Files

sec-daily-2020

2020年发布到阿尔法实验室微信公众号的所有安全资讯汇总

byPass_AV