gzsgcser Goto Github PK

meme-rw

用户模式线程 PreviousMode 设置为 KernelMode

memoryvirtualization

mminject

Kernel DLL Injector using NX Bit Swapping and VAD hide for hiding injected DLL

mouhidinputhook

MouHidInputHook enables users to filter, modify, and inject mouse input data packets into the input data stream of HID USB mouse devices without modifying the mouse device stacks.

mouseclassservicecallbackmeme

Calling "own" MouseClassServiceCallback

newhidedriverex

Hide Driver By MiProcessLoaderEntry

noscreen

Hiding the window from screenshots using the function win32kfull::ChangeWindowTreeProtection

nt-modules

Collect different versions of Crucial modules.

nullshit

Simple Null's driver detector

obfusion

Obfusion - C++ X86 Code Obfuscation Library

pe-dump-fixer

PE-Dump-Fixer

poseidon

stealthy UM <-> KM communication system without creating any system threads, permanent hooks, driver objects, section objects or device objects.

processhacker

A free, powerful, multi-purpose tool that helps you monitor system resources, debug software and detect malware—mirror of https://github.com/processhacker2/processhacker.git

rainbow

Hide SMBIOS/disk/NIC serials from EFI bootkit

registry-callbacks

UM-KM Communication using registry callbacks

rust_external

rw-no-attach

self-remapping-code

This program remaps its image to prevent the page protection of pages contained in the image from being modified via NtProtectVirtualMemory.

sessionmapper

将驱动映射到会话空间

shellcode-factory

shellcode 生成框架

simple-manual-map-injector

Simple C++ DLL Manual Map Injector For x86 and x64

smap

DLL scatter manual mapper

stealthy-kernelmode-injector

Manual mapper that uses PTE manipulation, Virtual Address Descriptor (VAD) manipulation, and forceful memory allocation to hide executable pages. (VAD hide / NX bit swapping)

steam-hook-render-poc

sysark

Sysark全称system anti-rootkit，是我学习内核写的工具（2013年的代码，后续不会再更新），里面基本上所有的功能都是用内核实现的。这里只是实现了反rootkit部分功能，作为工具的话，本人觉得还欠完善，但作为学习，或有人需要。目前针对的是XP SP2，对于其它版本的系统或者BSOD的问题，需要的人DIY一下。目前实现的功能： 进程/线程/模块、 驱动模块、 SSDT、 Shadow SSDT、 注册表——解析hive文件、 文件、 启动项、 服务

syscallhook

System call hook for Windows 10 20H1

theperfectinjector

Literally, the perfect injector.

ucxxrt

The Universal C++ RunTime library, supporting kernel-mode C++ exception-handler and STL.

umpmlib

A library to manipulate physical memory from usermode.

unrealdump