c0rtado Goto Github PK

persistence_demos

Demos of various (also non standard) persistence methods used by malware

pinjectra

Pinjectra is a C/C++ OOP-like library that implements Process Injection techniques (with focus on Windows 10 64-bit)

powerloaderex

PowerLoaderEx - Advanced Code Injection Technique for x32 / x64

ppldump

Dump the memory of a PPL with a userland exploit

process_chameleon

A process overwriting its own PEB to make an illusion that it has been loaded from a different path.

process_doppelganging

My implementation of enSilo's Process Doppelganging (PE injection technique)

process_ghosting

Process Ghosting - a PE injection technique, similar to Process Doppelgänging, but using a delete-pending file instead of a transacted file

process_overwriting

Yet another variant of Process Hollowing

qsynthesis

Greybox Synthesizer geared for deobfuscation of assembly instructions.

reclass.net-driverreader

Plugin for ReClass.Net (using vulnerable driver to read process memory)

reverse-engineering

A FREE comprehensive reverse engineering tutorial covering x86, x64, 32-bit ARM & 64-bit ARM architectures.

scyllahide

Advanced usermode anti-anti-debugger. Forked from https://bitbucket.org/NtQuery/scyllahide

secml_malware

Create adversarial attacks against machine learning Windows malware detectors

showstopper

ShowStopper is a tool for helping malware researchers explore and test anti-debug techniques or verify debugger plugins or other solutions that clash with standard anti-debug methods.

strivehitboxes

An in-game hitbox viewer for Guilty Gear Strive.

syscallhook

System call hook for Windows 10 20H1

syswhispers3

SysWhispers on Steroids - AV/EDR evasion via direct system calls.

tdl

Driver loader for bypassing Windows x64 Driver Signature Enforcement

titanengine

titanhide

Hiding kernel-driver for x86/x64.

transacted_hollowing

Transacted Hollowing - a PE injection technique, hybrid between ProcessHollowing and ProcessDoppelgänging

umpmlib

A library to manipulate physical memory from usermode.

unisthitboxes

UNIST hitbox viewer.

vtablekfunctionhook

This project will give you an example how you can hook a kernel vtable function that cannot be directly called

vx-api

Collection of various WINAPI tricks / features used or abused by Malware

whole-program-llvm

A wrapper script to build whole-program LLVM bitcode files

windbg-plugins

Any useful windbg plugins I've written.

windows_hardening

Windows Hardening settings and configurations

windowsexploitationresources

Resources for Windows exploit development

wpp

Intercepting DeviceControl via WPP