Reference 3600safeOpenSource

x64 use asm

HideProcess by Remove ProcessList in EPROCESS struct.

Reference IOCTL Fuzzer v1.2

atom-bombing-master
herpaderping-main
Process-Hollowing
ProcessDoppelgänging
ReflectiveDLLInjection
SetThreadContext to Inject support x64 and x86
SetWindowsHookEx to Inject
UserApcInject
ExtraWindowInject
CreateRemoteThread

Scan PE's IAT in PsSetLoadImageNotifyRoutine's callback

Enum Process By PsLookupProcessByProcessId/travel Active List/PspCidTable
Hdie Process By Process Active List/PspCidTable
Monitor Process CreateInformation By PsSetCreateProcessNotifyRoutineEx

Protect File in Windows 7 by ObRegisterCallbacks

Hook NtSetInformationFile to change target file
Hook NtWriteFile to write the target file
Hook NtDeleteFile to delete the target file
bind keyboard Filter Driver to avoid "ctrl+c" copy the content

Protect Process in Windows 7 by ObRegisterCallbacks

Reference 3600safeOpenSource

Check SSDT/ShadowSSDT Hook/InlineHook
Resume SSDT/ShadowSSDT Hook/InlineHook

Enum Module By NtQueryVirtualMemory