gavz Goto Github PK

amsi-etw-patch

Patch AMSI and ETW

amsi-provider

A fake AMSI Provider which can be used for persistence.

amsi-tracer

Leverage AMSI (Antimalware Scan Interface) technology to aid your analysis. This tool saves all buffers (scripts, .NET assemblies, etc) passed into AMSI during dynamic execution.

amsi.fail

C# Azure Function with an HTTP trigger that generates obfuscated PowerShell snippets that break or disable AMSI for the current process.

amsi_bypass

amsi_bypassr

AMSI bypass stager generator

amsi_handler

amsi_ordinal_bypass

Bypass AMSI and Defender using Ordinal Values

amsidetection

AMSI detection PoC

amsihooker

Hookers are cooler than patches.

amsipebwalkvba

Walking the PEB in VBA

amsipebwalkvbax64

amsiscanbuffer

Digging deeper into AmsiScanBuffer internals, and identifying 7 possibles AMSI patching by forcing a conditional jump to a branch that sets the return value of AmsiScanBuffer to E_INVALIDARG and makes the AmsiScanBuffer fails

amsiscanbufferbypass

amsiscanner

A C/C++ implementation of Microsoft's Antimalware Scan Interface

amsitrigger

The Hunt for Malicious Strings

an-intro-2-win-ed

"An Introduction to Windows Exploit Development" is an open sourced, free Windows exploit development course I created for the Southeast Missouri State University Cyber Range- based off of my exploit development highs and lows over the past few years.

analysis-of-anti-analysis

writings on anti-reverse engineering

analysis.oreans

🔎 Analysis of Oreans: Looking inside Themida, WinLicense, and CodeVirtualizer

analytic-password-cracking

analyzemft

analyzer-projects

Collection of scripts to be used with SATestBuild.py

anathema

.NET instrumentation framework

anbu

ANBU (Automatic New Binary Unpacker) generic unpacker with PIN DBI Framework. This project is only a way for me to learn about how to use PIN and how to implement interesting things with it, feel free to pull request what you think could be better.

anbu-1

ANBU (Automatic New Binary Unpacker) a tool for me to learn about PIN and about algorithms for generic unpacking.

andrewspecial

AndrewSpecial, dumping lsass' memory stealthily and bypassing "Cilence" since 2019.

andriller

Andriller - is software utility with a collection of forensic tools for smartphones. It performs read-only, forensically sound, non-destructive acquisition from Android devices.

android-certkiller

Script to Bypass SSL/Certificate Pinning in Android

android-gif-drawable

Views and Drawable for displaying animated GIFs on Android

android-imsi-catcher-detector

AIMSICD • Fight IMSI-Catcher, StingRay and silent SMS!