3d-injector

a-protect

fork from A-Protect

access

Access without a real handle

akamai-security-research

This repository includes code and IoCs that are the product of research done in Akamai's various security research teams.

alpc-example

An example of a client and server using Windows' ALPC functions to send and receive data.

alpclogger

Log ALPC activity

angryorchard

A kernel exploit leveraging NtUserHardErrorControl to elevate a thread to KernelMode and achieve arbitrary kernel R/W & more.

anti-rootkit

anycall

x64 Windows kernel code execution via user-mode, arbitrary syscall, vulnerable IOCTLs demonstration

anyvtop

x64 Windows implementation of virtual-address to physical-address translation

apicallproxy

Windows API Call Obfuscation (Driver ring0 implementation)

ark

Ark

asmshellcodeloader

汇编语言编写Shellcode加载器源代码 https://payloads.online/archivers/2022-02-16/1/

autochk-rootkit

Reverse engineered source code of the autochk rootkit

awesome-windows-kernel-security-development

windows kernel security development

awesome_windows_logical_bugs

collect for learning cases

banshee

Experimental Windows x64 Kernel Rootkit.

be-injector

blacklotus

BlackLotus UEFI Windows Bootkit

blindeye

BattlEye kernel module bypass

bootlicker

A generic UEFI bootkit used to achieve initial usermode execution. It works with modifications.

bugchecker

SoftICE-like kernel debugger for Windows 11

bugchecker2002

SoftICE-like debugger for Windows 2000 and XP. Archived.

captain

Process Creation, Image Load and Thread Creation Notification

cdpsvclpe

Windows Local Privilege Escalation via CdpSvc service (Writeable SYSTEM path Dll Hijacking)

cgaty

Hooking the GDT - Installing a Call Gate. POC for Rootkit Arsenal Book Second Edition (version 2022)

chaos-rootkit

x64 ring0 Rootkit with Process Hiding and Privilege Escalation Capabilities

createprocessinternalw-full

Reimplement CreateProcessInternalW via Windows 10 20H1+ Base on NtCreateUserProcess-Post

critsectionvskernelobject

POC project to demonstrate performance difference between a critical section and a synchronization kernel object in Windows.

cve-2021-21551

arbitrary kernel read/write in dbutil_2_3.sys, Proof of Concept Local Privilege Escalation to nt authority/system