Beast code in Giters

shaygitub's starred repositories

windows-internals

My notes while studying Windows internals

Language:CMIT37400

windows-exploitation

My notes while studying Windows exploitation

Language:C++MIT17800

Stealthy-Kernelmode-Injector

Manual mapper that uses PTE manipulation, Virtual Address Descriptor (VAD) manipulation, and forceful memory allocation to hide executable pages. (VAD hide / NX bit swapping)

Language:C27500

Poseidon

Stealthy UM <-> KM communication system without creating any system threads, permanent hooks, driver objects, section objects or device objects.

Language:C++34300

Prevent_File_Deletion

Record & prevent file deletion in kernel mode

Language:CMIT3800

KeystrokeSniffer

a windows kernel keylogger that works

Language:C++MIT1700

FileHide

filter driver to hide files and directories

Language:C++MIT1000

MinifilterHook

silence file system monitoring components by hooking their minifilters

Language:C4100

GhostMapperUM

manual map unsigned driver over signed memory

Language:C++14000

WindowsRegistryRootkit

Kernel rootkit, that lives inside the Windows registry values data

Language:C48000

WinDbg_Scripts

Useful scripts for WinDbg using the debugger data model

Language:JavaScript38000

A free, powerful, multi-purpose tool that helps you monitor system resources, debug software and detect malware. Brought to you by Winsider Seminars & Solutions, Inc. @ http://www.windows-internals.com

Language:CMIT1065200

SimpleVisor

SimpleVisor is a simple, portable, Intel VT-x hypervisor with two specific goals: using the least amount of assembly code (10 lines), and having the smallest amount of VMX-related code to support dynamic hyperjacking and unhyperjacking (that is, virtualizing the host state from within the host). It works on Windows and UEFI.

Language:C169700