Lists (1)
Stars
A more stealthy variant of "DLL hollowing"
It's a minifilter used for transparent-encrypting.
PVE Debain Ubuntu ArchLinux virtual machine emulates a physical machine to avoid(or anti) detection（pve Debian Ubuntu ArchLinux虚拟机模拟真实机器防检测）
Hide Driver By MiProcessLoaderEntry
PoC memory injection detection agent based on ETW, for offensive and defensive research purposes
Utilizing TLS callbacks to execute a payload without spawning any threads in a remote process
This is a PoC for bypassing UAC using DLL hijacking and abusing the "Trusted Directories" verification.
Kernel driver loader using vulnerable gigabyte driver (https://www.secureauth.com/labs/advisories/gigabyte-drivers-elevation-privilege-vulnerabilities) to load a unsigned driver
Waiting Thread Hijacking - injection by overwriting the return address of a waiting thread
ChimeraPE (a PE injector type - alternative to: RunPE, ReflectiveLoader, etc) - a template for manual loading of EXE, loading imports payload-side
modify from memorymodule. support exception
Kernel DLL Injector using NX Bit Swapping and VAD hide for hiding injected DLL
x64 Windows PatchGuard bypass, register process-creation callbacks from unsigned code
Proof of Concepts code for Bring Your Own Vulnerable Driver techniques
CIA UAC bypass implementation that utilizes elevated COM object to write to System32 and an auto-elevated process to execute as administrator.
KDP compatible unsigned driver loader leveraging a write primitive in one of the IOCTLs of gdrv.sys