xrv3ovl Goto Github PK

physmem_drivers

A collection of various vulnerable (mostly physical memory exposing) drivers.

pigsyscall

An implementation of an indirect system call

pinkpanther

Windows x64 handcrafted token stealing kernel-mode shellcode

ppdump-public

Protected Process (Light) Dump: Uses Zemana AntiMalware Engine To Open a Privileged Handle to a PP/PPL Process And Inject MiniDumpWriteDump() Shellcode

pplib

Elevate a process to be a protected process

proxy-function-calls-for-etwti

The code is a pingback to the Dark Vortex blog: https://0xdarkvortex.dev/hiding-memory-allocations-from-mdatp-etwti-stack-tracing/

realblindingedr

Remove AV/EDR Kernel ObRegisterCallbacks、CmRegisterCallback、MiniFilter Callback、PsSetCreateProcessNotifyRoutine Callback、PsSetCreateThreadNotifyRoutine Callback、PsSetLoadImageNotifyRoutine Callback...

rebirthguard

Anti-cheat library for Windows C++

rtypes

A simple but useful project maybe help you reverse Windows.

shadow_syscall

convenient use of syscalls with a single line and a comfort wrapper, unfriendly for reverse engineer

shannon_modem_loader

shannonfirmware

Samples of Shannon baseband firmware for research purposes.

shothv

ShotHv

signthief

Windows PE Signature Thief in C++

sigscanner

Windows internal signature scanner

simplewhpdemo

Simple Demo of using Windows Hypervisor Platform

siren-hypervisor

smartvmi

Virtual Machine Introspection (VMI) for memory forensics and machine-learning.

ssde

SSDE is a collection of utilities that help in having Windows load your custom signed kernel drivers when Secure Boot is on and you own the system's platform key, instead of using test mode.

stardust

A modern 64-bit position independent implant template

starryeye

Windows Anti-Rootkit Weapon

syserdebugger

system_trace_tool

内核驱动加载/卸载痕迹清理,努力绕过反作弊吧 PiDDBCacheTable and MmLastUnloadedDriver

systems-theory

syzkaller-win

t.d.p

Using Thread Description To Hide Shellcode

tamperingsyscalls

thesubzeroproject

A multi-staged malware that contains a kernel mode rootkit and a remote system shell.

usblocker

Disable any USB Mass Storage device from kmode using a pnp filter driver

vc-ltl

Shared to msvcrt.dll and optimize the C/C++ application file size.