A .NET assembly tracer using Harmony for runtime method interception.

kernel callback removal (Bypassing EDR Detections)

POC exploit for CVE-2025-21333 heap-based buffer overflow. It leverages WNF state data and I/O ring IOP_MC_BUFFER_ENTRY

protector & obfuscator & code virtualizer

shell code example

Hooking Windows' exception dispatcher to protect process's PML4

A Linux kernel rootkit in Rust using a custom made type-2 hypervisor, eBPF XDP and TC programs

Leverage a legitimate WFP callout driver to prevent EDR agents from sending telemetry

A tool uses Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server.

Rootkit for the blue team. Sophisticated and optimized LKM to detect and prevent malicious activity

Exploit targeting NT kernel in 24H2 Windows Insider Preview

A fork of AFL for fuzzing Windows binaries

A Linux eBPF rootkit with a backdoor, C2, library injection, execution hijacking, persistence and stealth capabilities.

Nidhogg is an all-in-one simple to use rootkit.

Dynamically convert a native EXE to PIC shellcode by prepending a shellcode stub

Collection of various malicious functionality to aid in malware development

An EDR bypass that prevents EDRs from hooking or loading DLLs into our process by hijacking the AppVerifier layer

A modern 64-bit position independent implant template

An interactive shell to spoof some LOLBins command line

LLVM plugin to transparently apply stack spoofing and indirect syscalls to Windows x64 native calls at compile time.

Detect WFP filters blocking EDR communications

CIA UAC bypass implementation of Stinger that obtains the token from an auto-elevated process, modifies it, and reuses it to execute as Administrator.

A proof of concept for abusing exception handlers to hook and bypass user mode EDR hooks.

A set of fully-undetectable process injection techniques abusing Windows Thread Pools

Little AV/EDR bypassing lab for training & learning purposes

Black Angel is a Windows 11/10 x64 kernel mode rootkit. Rootkit can be loaded with enabled DSE while maintaining its full functionality.

Vulnerable driver research tool, result and exploit PoCs