a10ncoder

al-khaser

Public malware techniques used in the wild: Virtual Machine, Emulation, Debuggers, Sandbox detection.

CallMon

CallMon is an experimental system call monitoring tool that works on Windows 10 versions 2004+ using PsAltSystemCallHandlers

CheekyBlinder

Enumerating and removing kernel callbacks using signed vulnerable drivers

CobaltStrike

CobaltStrike's source code

Cpp-High-Performance-Second-Edition

C++ High Performance Second Edition, published by Packt

DoublePulsarPayload

C++ implementation of DOUBLEPULSAR usermode shellcode. Yet another Reflective DLL loader.

fibratus

A modern tool for the Windows kernel exploration and tracing

FsMinfilterHooking

herpaderping

Process Herpaderping proof of concept, tool, and technical deep dive. Process Herpaderping bypasses security products by obscuring the intentions of a process.

HookLib

The functions interception library written on pure C and NativeAPI with UserMode and KernelMode support

In-memory-Attack

In-memory Attack

KasperskyHook

Hook system calls on Windows by using Kaspersky's hypervisor

Kernel-Bridge

Windows kernel hacking framework, driver template, hypervisor and API written on C++

kernel-codecave-poc

Proof of concept on how to bypass some limitations of a manual mapped driver

MagicLib

Non organized Cpp code files I used for my research on Windows

Mapping-Injection

Just another Windows Process Injection

MemoryRanger

MemoryRanger protects kernel data and code by running drivers and hosting data in isolated kernel enclaves using VT-x and EPT features. MemoryRanger has been presented at the BlackHat, HITB, CDFSL.

moneta

Moneta is a live usermode memory analysis tool for Windows with the capability to detect malware IOCs

openedr

Open EDR public repository

PIC-Get-Privileges

Building and Executing Position Independent Shellcode from Object Files in Memory

PPLKiller

Protected Processes Light Killer

ProcMonXv2

Process Monitor X v2

rust-windows-shellcode

Windows shellcode development in Rust

SassyKitdi

Kernel Mode TCP Sockets + LSASS Dump (Rust Shellcode)

Shark

Turn off PatchGuard in real time for win7 (7600) ~ win10 (19041).

SimpleSvm

A minimalistic educational hypervisor for Windows on AMD processors.

SimpleSvmHook

SimpleSvmHook is a research purpose hypervisor for Windows on AMD processors.

spectre

A Windows kernel-mode rootkit that abuses legitimate communication channels to control a machine.

syscall-detect

PoC capable of detecting manual syscalls from usermode.

TelemetrySourcerer

Enumerate and disable common sources of telemetry used by AV/EDR.