Build cross-platform desktop apps with JavaScript, HTML, and CSS

Public malware techniques used in the wild: Virtual Machine, Emulation, Debuggers, Sandbox detection.

An even funnier way to disable windows defender. (through WSC api)

KDMapper is a simple tool that exploits iqvw64e.sys Intel driver to manually map non-signed drivers in memory

A JIT assembler for x86/x64 architectures supporting FPU, MMX, SSE (1-4), AVX (1-2, 512), APX, and AVX10.2

Disable PatchGuard and Driver Signature Enforcement at boot time

Nidhogg is an all-in-one simple to use windows kernel rootkit.

x64 binary obfuscator

Modern graphing calculator operating system.

Custom Command and Control (C3). A framework for rapid prototyping of custom C2 channels, while still providing integration with existing offensive toolkits.

Alternative Shellcode Execution Via Callbacks

Examples for using ONNX Runtime for machine learning inferencing.

Extracting Clear Text Passwords from mstsc.exe using API Hooking.

EDR Lab for Experimentation Purposes

Process Hollowing (Malware Technique)

Hide your Powershell script in plain sight. Bypass all Powershell security features

Remove AV/EDR Kernel ObRegisterCallbacks、CmRegisterCallback、MiniFilter Callback、PsSetCreateProcessNotifyRoutine Callback、PsSetCreateThreadNotifyRoutine Callback、PsSetLoadImageNotifyRoutine Callback...

A set of fully-undetectable process injection techniques abusing Windows Thread Pools

Thread Stack Spoofing - PoC for an advanced In-Memory evasion technique allowing to better hide injected shellcode's memory allocation from scanners and analysts.

Shellcode Compiler

An advanced in-memory evasion technique fluctuating shellcode's memory protection between RW/NoAccess & RX and then encrypting/decrypting its contents

Reproducing Spyboy technique to terminate all EDR/XDR/AVs processes

Obfuscate specific windows apis with different apis

Loading Remote AES Encrypted PE in memory , Decrypted it and run it

Now You See Me, Now You Don't

A library for doing homomorphic encryption operations on tensors

Tool to bypass LSA Protection (aka Protected Process Light)

New version of RottenPotato as a C++ DLL and standalone C++ binary - no need for meterpreter or other tools.

Run a Exe File (PE Module) in memory (like an Application Loader)

Cronos is Windows 10/11 x64 ring 0 rootkit. Cronos is able to hide processes, protect and elevate them with token manipulation.