This is an advanced Windows loader framework designed for stealthy code injection, anti-analysis, and evasion. It combines direct system call invocation, API hashing, anti-analysis techniques, and …

Proof-of-concept kernel driver that hijacks the Windows kernel extension table mechanism to preserve process notify callbacks even when attackers disable standard process notify callbacks.

硬件序列管理者

A simple emulator for Windows designed for reverse engineering, testing binary files, and execution logging.

Load a dynamic library from memory by modifying the native Windows loader

LLVM Pass Plugin for obfuscating imported/resolved functions using `GetProcAddress` (x64)

Inject unsigned DLL into Protected Process Light (PPL)

（communication detected）a kernel driver for game cheater. includes read&write memory / key&mouse simulator / kernel DWM render / process hider / kernel remote call / force delete file / remote thre…

kernel-mode DLL Injector

Kairos is a next-generation, red-team-oriented Windows kernel defense neutralization framework. It combines traditional runtime patching with UEFI persistence, hypervisor-level surveillance, and Se…

A Windows library for doing things you probably shouldn’t be doing with processes, tokens, and system calls.

Hooking KPRCB IdlePreselect function to gain execution inside PID 0.

EncryptIAT

Reports on Driver, LSASS and other security services mitigations

POC shared memory driver using the clients exception handler as user-kernel communication.

LD_PRELOAD Rootkit

所有小初高、大学PDF教材。

My personal / private P2C Project undetected for 8- Months Straight leaked & resold so I am publishing it to piss them off.

kernel callback removal (Bypassing EDR Detections)

HyperVeil is a sophisticated System Management Mode (SMM) framework that demonstrates how hardware-level memory access can be implemented securely.

Implementing the ghostly hollowing PE injection technique using tampered syscalls.

A perfect driver for game hack

Hooking Windows' exception dispatcher to protect process's PML4

miscellaneous scripts and programs

KMS 激活服务，slmgr 命令激活 Windows 系统、Office

Turing-complete 64-bit virtual machine written in C++ and C#