luom

AES

C++ AES implementation

AliPCS-Py

Aliyundrive API & App 阿里云盘 API 和 客户端

GoogleTranslate_IPFinder

谷歌翻译服务器在**大陆的IP地址扫描、测速工具。

FakeSign

自建时间戳服务器实现伪签名驱动证书 Implementing Pseudo Signature with Self-Sign Timestamp Servers

MemoryModule

A flexible PE loader, loading module in memory. Most of the functions can be inline, compatible for shellcode.

MemoryModule

Library to load a DLL from memory.

LoudSunRun

Stack Spoofing with Synthetic frames based on the work of namazso, SilentMoonWalk, and VulcanRaven

GoogleTranslateIpCheck

EDRSandblast

auto-cpufreq

Automatic CPU speed & power optimizer for Linux

Cortex-XDR-Config-Extractor

Cortex XDR Config Extractor

InlineExecute-Assembly

InlineExecute-Assembly is a proof of concept Beacon Object File (BOF) that allows security professionals to perform in process .NET assembly execution as an alternative to Cobalt Strikes traditional fork and run execute-assembly module

.NetConfigLoader

.net config loader

Journey-to-McAfee

SuperCMD

Run program as SYSTEM, with TrustedInstaller token if desired

RealBlindingEDR

Remove AV/EDR Kernel ObRegisterCallbacks、CmRegisterCallback、MiniFilter Callback、PsSetCreateProcessNotifyRoutine Callback、PsSetCreateThreadNotifyRoutine Callback、PsSetLoadImageNotifyRoutine Callback...

callstack_spoof

HookTools

Plugin for Process Hacker 2 ( https://github.com/processhacker2 ), displays system hooks and able to unhook too.

Arkari

Yet another llvm based obfuscator based on goron.

Pluto

Obfuscator based on LLVM 14.0.6

ToyObfuscator

Toy LLVM obfuscator pass

SharpGmailC2

Our Friendly Gmail will act as Server and implant will exfiltrate data via smtp and will read commands from C2 (Gmail) via imap protocol

Elevate-System-Trusted-BOF

ews-cpp

A C++11 header-only library for Microsoft Exchange Web Services

realm

A network relay tool

dbxcli

A command line client for Dropbox built using the Go SDK

NVDrv

Abusing nvidia driver (nvoclock.sys) for physical/virtual memory and control register manipulation.

angryorchard

A kernel vulnerability used to achieve arbitrary read-write on Windows prior to July 2022

ShelbyObfuscator

Obfuscator for llvm 16.0.2

EDR-Telemetry

This project aims to compare and evaluate the telemetry of various EDR products.