c0rtado Goto Github PK

al-khaser

Public malware techniques used in the wild: Virtual Machine, Emulation, Debuggers, Sandbox detection.

antianalysis_demos

Set of antianalysis techniques found in malware

anticheat-testing-framework

Framework to test any Anti-Cheat

antivmdetection

Script to create templates to use with VirtualBox to make vm detection harder

arcinject

Overwrite a process's recovery callback and invoke a crash to execute

backstab

A tool to kill antimalware protected processes

bananaphone

It's a go variant of Hells gate! (directly calling windows kernel functions, but from Go!)

beaengine

BeaEngine disasm project

capcom-drvmap

chimera_pe

ChimeraPE (a PE injector type - alternative to: RunPE, ReflectiveLoader, etc) - a template for manual loading of EXE, loading imports payload-side

cpp-implant

A simple implant showcasing modern C++

demos

Demos of various injection techniques found in malware

detours

Detours is a software package for monitoring and instrumenting API calls on Windows. It is distributed in source code form.

disable-threat-tracing

Disable threat tracing from the kernel..

dll_injector

A simple commandline injector using classic DLL injection

drvmap

driver mapper / capcom wrapper

dumpert

LSASS memory dumper using direct system calls and API unhooking.

eac-reversal

09/2021 reversal of EasyAntiCheat driver

edrs

eft

ezetw

Cmdlets for capturing Windows Events

face-injector-v2

update face injector by KANKOSHEV

foliage

Experiment on reproducing Obfuscate & Sleep

functionstomping

A new shellcode injection technique. Given as C++ header, standalone Rust program or library.

funky_malware_formats

Parsers for custom malware formats ("Funky malware formats")

gargoyle

A memory scanning evasion technique

gcc

handlekatz

PIC lsass dumper using cloned handles

herpaderping

Process Herpaderping proof of concept, tool, and technical deep dive. Process Herpaderping bypasses security products by obscuring the intentions of a process.

hikari

LLVM Obfuscator