gzsgcser Goto Github PK

rtcore64_vulnerability

Use RTCore64 to map your driver on windows 11.

rust_external

rw-no-attach

rwcommunication

self-remapping-code

This program remaps its image to prevent the page protection of pages contained in the image from being modified via NtProtectVirtualMemory.

sessionmapper

将驱动映射到会话空间

shellcode-factory

shellcode 生成框架

simple-manual-map-injector

Simple C++ DLL Manual Map Injector For x86 and x64

simpledriver

伪造返回值读写物理内存劫持IO

smap

DLL scatter manual mapper

stealthy-kernelmode-injector

Manual mapper that uses PTE manipulation, Virtual Address Descriptor (VAD) manipulation, and forceful memory allocation to hide executable pages. (VAD hide / NX bit swapping)

steam-hook-render-poc

stlkrn

C++ STL in the Windows Kernel with C++ Exception Support

subgetvariable

Old project (2020) reformed. Modifies gRT->GetVariable sub function from EFI_APPLICATION. Tested on Win10 22H2 (AMD).

swh-injector

An Injector that can inject dll into game process protected by anti cheat using SetWindowsHookEx.一个注入器，可以使用 SetWindowsHookEx 将 dll 注入受反作弊保护的游戏进程中。

sysark

Sysark全称system anti-rootkit，是我学习内核写的工具（2013年的代码，后续不会再更新），里面基本上所有的功能都是用内核实现的。这里只是实现了反rootkit部分功能，作为工具的话，本人觉得还欠完善，但作为学习，或有人需要。目前针对的是XP SP2，对于其它版本的系统或者BSOD的问题，需要的人DIY一下。目前实现的功能： 进程/线程/模块、 驱动模块、 SSDT、 Shadow SSDT、 注册表——解析hive文件、 文件、 启动项、 服务

syscallhook

System call hook for Windows 10 20H1

systeminformer

A free, powerful, multi-purpose tool that helps you monitor system resources, debug software and detect malware. Brought to you by Winsider Seminars & Solutions, Inc. @ http://www.windows-internals.com

theperfectinjector

Literally, the perfect injector.

uc-apex-remastered

ucmapper

Unknowncheats Magically Optimized Tidy Mapper using nvaudio

ucxxrt

The Universal C++ RunTime library, supporting kernel-mode C++ exception-handler and STL.

uiaccess

通过System令牌获取UIAccess

umpmlib

A library to manipulate physical memory from usermode.

unrealdump

voidmap

vtablekfunctionhook

This project will give you an example how you can hook a kernel vtable function that cannot be directly called

vulnerable_asromgdrv_28_09_2012

win32k_file_collection

Collect various versions of win32k files

win32kernelstl

Using C++ STL on Windows kernle development