ntdll

Detours with just single dependency - NTDLL

Contains the definitions for the Windows Internal UserMode API from ntdll.dll, samlib.dll and winsta.dll.

Go shellcode loader that combines multiple evasion techniques

Debug Child Process Tool (auto attach)

Inline syscalls made for MSVC supporting x64 and WOW64

The history of Windows Internals via symbols.

Simple project that demonstrates how an ETW consumer can be created just by using NTDLL

ntdll.h - compatible with MSVC 6.0, Intel C++ Compiler and MinGW. Serves as a complete replacement for Windows.h

Collect different versions of Crucial modules.

Bypass for CS:GO's LoadLibrary injection prevention mechanism, achieved by patching one byte of game memory.

An improved Detours.

Use ntdll/ntoskrnl to implement Kernel32, Advapi32 and other APIs. It includes user-mode and kernel-mode.

woftool is a proof-of-concept utility for creating WOF-compressed files

Dump system call codes, names, and offsets from Ntdll.dll

This repository houses an extensive collection of .def files, which are header files containing enumerations of entry points for various native libraries. These entry points serve as essential references for developers seeking to interact with these libraries from their codebases.

Go interface to NTDLL functions

SysCaller: SDK for WindowsAPI via syscalls. Dynamic Resolution, Obfuscation, Multi-Language Bindings, & more!

proper ntdll .text section unhooking via native api. unlike other unhookers this doesnt leave 2 ntdlls loaded. x86/x64/wow64 supported.

SysWhispers & HellsGate successor, executing protected Indirect & Direct syscalls in EDR protected settings

DirectNtApi - simple method to make ntapi function call without importing or walking export table. Work under Windows 7, 8 and 10