x1tan

Direct-Syscalls-vs-Indirect-Syscalls

The following two code samples can be used to understand the difference between direct syscalls and indirect syscalls

InviZzzible

InviZzzible is a tool for assessment of your virtual environments in an easy and reliable way. It contains the most recent and up to date detection and evasion techniques as well as fixes for them.

VMAware

VM detection library and tool

tpm-spoofer

Simple proof of concept kernel mode driver hooking tpm.sys dispatch to randomize any public key reads

FireDBG.for.Rust

🔥 Time Travel Visual Debugger for Rust

perses

X86 Mutation Engine with Portable Executable compatibility.

obfuscator

PE bin2bin obfuscator

rust-cpuid

cpuid library in rust.

x86_64

Library to program x86_64 hardware.

vmprotect-3.5.1

PPLKiller

Protected Processes Light Killer

showstopper

ShowStopper is a tool for helping malware researchers explore and test anti-debug techniques or verify debugger plugins or other solutions that clash with standard anti-debug methods.

PigPEI

PEIM (UEFI) bootkit targeting OVMF (EDK2)

WinDbg-JS

guardian-rs

x86-64 code/pe virtualizer

DirectPageManipulation

A basic demonstration of directly overwriting paging structures for physical memory r/w and interprocess memory copy

OffensivePH

OffensivePH - use old Process Hacker driver to bypass several user-mode access controls

bread

🍞 BREAD: BIOS Reverse Engineering & Advanced Debugger

symless

Killer

Killer tool is designed to bypass AV/EDR security tools using various evasive techniques.

shadow_syscall

convenient use of syscalls with a single line and a comfort wrapper, unfriendly for reverse engineer

Voyager

A Hyper-V Hacking Framework For Windows 10 x64 (AMD & Intel)

VDM

Library to manipulate drivers that expose a physical memory read/write primitive.

msrexec

Elevate arbitrary MSR writes to kernel execution.

process_doppelganging

My implementation of enSilo's Process Doppelganging (PE injection technique)

vmhook

A demonstration of hooking into the VMProtect-2 virtual machine

theodosius

Small OBJ/Archive Obfuscation framework

pdb-rs

A parser for Microsoft PDB (Program Database) debugging information

binja-rs

Some Rust bindings for Binary Ninja

rewind

Snapshot-based coverage-guided windows kernel fuzzer