Stars
Tool to statically recompile N64 games into native executables
A set of fully-undetectable process injection techniques abusing Windows Thread Pools
Obfuscate specific windows apis with different apis
Moneta is a live usermode memory analysis tool for Windows with the capability to detect malware IOCs
HWSyscalls is a new method to execute indirect syscalls using HWBP, HalosGate and a synthetic trampoline on kernel32 with HWBP.
CVE-2020-15368, aka "How to exploit a vulnerable driver"
A collection of LLVM transform and analysis passes to write shellcode in regular C
HyperDeceit is the ultimate all-in-one library that emulates Hyper-V for Windows, giving you the ability to intercept and manipulate operating system tasks with ease.
Hijacking valid driver services to load arbitrary (signed) drivers abusing native symbolic links and NT paths
Demo proof of concept for shadow regions, and implementation of HyperDeceit.
A simple ptrace-less shared library injector for x64 Linux
Two new offensive techniques using Windows Fibers: PoisonFiber (The first remote enumeration & Fiber injection capability POC tool) PhantomThread (An evolved callstack-masking implementation)
Post exploitation technique to turn arbitrary kernel write / increment into full read/write primitive on Windows 11 22H2
A set of programs for analyzing common vulnerabilities in COM
Inline syscalls made for MSVC supporting x64 and WOW64
Uses Threat-Intelligence ETW events to identify shellcode regions being hidden by fluctuating memory protections
Cobaltstrike Reflective Loader with Synthetic Stackframe
Simple POC library to execute arbitrary calls proxying them via NdrServerCall2 or similar
Embedder is a collection of sources in different languages to embed Python interpreter with minimal dependencies
MIPS VM to execute payloads without allocating executable memory. Based on a PlayStation 1 (PSX) Emulator.
Integration of Microsoft Warbird with the MSVC compiler
Lateral Movement via the .NET Profiler