hkfans Goto Github PK

al-khaser

Public malware techniques used in the wild: Virtual Machine, Emulation, Debuggers, Sandbox detection.

antispy

AntiSpy is a free but powerful anti virus and rootkits toolkit.It offers you the ability with the highest privileges that can detect,analyze and restore various kernel modifications and hooks.With its assistance,you can easily spot and neutralize malwares hidden from normal detectors.

arkari

Yet another llvm based obfuscator based on goron.

bedaisy-reversal

Some psuedo snippets from BattlEye's BEDaisy.sys loaded on Rainbow Six: Siege.

cheat-engine

Cheat Engine. A development environment focused on modding

cinject

Windows Kernel inject (no module no thread)

deletefilebycreateirp

通过创建Irp删除文件，代码抄袭自某杀毒软件*86部分，因此可以看到IDA痕迹

detect-vm-and-hypervisor

Detect VM and Hypervisor

distorm

Powerful Disassembler Library For x86/AMD64

eac-cr3-bypass

A simple UM + KM example of how to bypass EAC CR3

eacreversing

Reversing EasyAntiCheat.

easyanticheat-src

force-page-protection

This x64dbg plugin sets the page protection for memory mapped views in scenarios which cause NtProtectVirtualMemory to fail.

fu_hypervisor

A hypervisor hiding user-mode memory using EPT

goodeye

https://githacks.org/Shawick/goodeye.git

hook-kdtrap

hookmsrbysvm

hook msr by amd svm

hvpp

hvpp is a lightweight Intel x64/VT-x hypervisor written in C++ focused primarily on virtualization of already running operating system

hydrahook

EasyAntiCheat Hydra Hook after lucasroe666

hyperbone

Minimalistic VT-x hypervisor with hooks

hyperplatform

Intel VT-x based hypervisor aiming to provide a thin VM-exit filtering platform on Windows.

hypervisor

lightweight hypervisor SDK written in C++ with support for Windows, Linux and UEFI

infinityhook

Hook system calls, context switches, page faults and more.

kasperskyhook

Hook system calls on Windows by using Kaspersky's hypervisor

kernel-bridge

Windows kernel hacking framework, driver template, hypervisor and API written on C++

kernelmodestl

Kernel Mode c++ STL for windows driver

khypervisor

kHypervisor is a lightweight bluepill-like nested VMM for Windows, it provides and emulating a basic function of Intel VT-x

ksocket

KSOCKET provides a very basic example how to make a network connections in the Windows Driver by using WSK

llvm2019

Visual Studio 2019 extension for building C/C++ projects with the LLVM Compiler Toolchain (installed separately).

memorymodulepp

modify from memorymodule. support exception