nicholasvg Goto Github PK

2022-04-02-malware-injection-18

Find kernel32 base and API addresses. Simple C++ implementation

androspy

An Android RAT that written in C# by me

anti-runpe

Terminate processes that have been infected with malware using runpe

basic-rootkit

POC Ring3 Windows Rootkit (x86 / x64) - Hide processes and files

blackbone

Windows memory hacking library

bleak

A Windows native DLL injection library that supports several methods of injection.

crossinject

x86/x64 dll injector

customkeyboardlayoutpersistence

Achieve execution using a custom keyboard layout

cve-2020-0796

CVE-2020-0796 - Windows SMBv3 LPE exploit #SMBGhost

direct3dhook

DirectX Capture and Overlays by using Direct3D API hooks

dotnet-window-capture

Captures a window or desktop screen and renders it in WPF or DirectX.

dreamloader

Simple 32/64-bit PEs loader.

executeassembly

Load/Inject .NET assemblies by; reusing the host (spawnto) process loaded CLR AppDomainManager, Stomping Loader/.NET assembly PE DOS headers, Unlinking .NET related modules, bypassing ETW+AMSI, avoiding EDR hooks via NT static syscalls (x64) and hiding imports by dynamically resolving APIs (hash).

explorer-infection

Infecting explorer.exe with payload to infect new process creation

foliage

Experiment on reproducing Obfuscate & Sleep

gopherheaven

Go implementation of the Heaven's Gate technique

havoc

The Havoc Framework

hellsrunpe

RunPE using Hell's Gate technique.

hideprocesshook

DLL that hooks the NtQuerySystemInformation API and hides a process name

hostingclr

Executing a .NET Assembly from C++ in Memory (CLR Hosting)

httprequest

Single-header C++ HTTP request class

inject-custom-function

Inject custom dll to process and execute function remotely.

inject-dll-by-process-doppelganging

Process Doppelgänging

injection

injectors

💉 DLL/Shellcode injection techniques

injectory

command-line interface dll injector

kaynldr

KaynLdr is a Reflective Loader written in C/ASM

latebros

x64 usermode rootkit

lunar

A lightweight native DLL mapping library that supports mapping directly from memory

malware

malware source codes