153 matches found
MalDev
MalDev Hey! Welcome to my repo : I am Captain Magma, a passionate individual dedicated to cybersecurity, malware development, and analysis. The design for this repository is to manage my MalDev road-path as I learn and update this repository with my notes and code. I am not the author of any of...
stealth_call
What is this? Header-only library for Windows x64 that lets you invoke any NT syscall without touching ntdll imports, without leaving strings in your binary, and without the usual red flags that make EDRs lose their minds. No CRT. No STL. No IAT. The whole thing compiles down to 19KB with literal...
NTDLL-Unhook
NTDLL Unhook proper ntdll .text section unhooking via native api. x86/x64/wow64 supported. How It Works The program walks the PEB to locate ntdll.dll base address and manually parses the PE export table to resolve NT API functions without touching the Import Address Table. It then uses NtOpenFile...
HallWatch
HallWatch Copyright C 2026 Adam Zypherion — licensed under GPL-3.0. Indirect syscalls are simple once you have seen one. The loader walks ntdll, reads the SSN out of Nt prologue, finds the 0F 05 two bytes further in, sets r10/rax/rdx/r8/r9 itself, and jmps straight at those two bytes. The syscall...
NyxInvoke
NyxInvoke NyxInvoke is a versatile Rust-based tool designed for executing .NET assemblies, PowerShell commands/scripts, Beacon Object Files BOFs and PE files with built-in Ntdll Unhooking, patchless AMSI and ETW bypass capabilities. It can be compiled as either a standalone executable or a DLL...
WTSRM
WTSRM - Writing Tiny Small Reliable Malware demo repository for my corresponding talk. Unhooks all Windows Dlls with \KnownDlls\ No CRT dependencies Small size Low entropy Random string encryption key thus no plaintext strings API hashing Hook detection Walks around hooks for initial unhooking on...
nim-loader
nim-loader nim을 배우는 여정에서 여러 리소스를 조합하여 일반적인 EDR/AV 회피 기법을 구현한 셸코드 로더를 만든, 매우 조잡하고 진행 중인 프로젝트입니다. 이것은 난장판이며 연구 목적으로만 사용하세요! 수정 없이 컴파일 및 실행이 될 것이라고 기대하지 마십시오. 지침 loader.nim의 바이트 배열을 자신의 x64 셸코드로 교체하세요. EXE를 컴파일하고 실행: nim c -d:danger -d:strip --opt:size "loader.nim" 사용 중인 인젝션 폴더 메서드의 .nim 파일을 확인하여 인젝...
MemFiles
MemFiles DISCLAIMER: This project is complex and failure to understand how it works and adequately test it can result in you crashing Beacons and losing access! I highly encourage you to read all of the documentation up until the "Technical Details, Design Considerations, and Commentary" section!...
ntqueueapcthreadex-ntdll-gadget-injection
🧪 NtQueueApcThreadEx NTDLL Gadget Injection Introduction This novel way of using NtQueueApcThreadEx by abusing the ApcRoutine and SystemArgument0-3 parameters by passing a random pop r32; ret gadget can be used for stealthy code injection. Within this PoC, the gadget in this case is picked random...
ntdlll-unhooking-collection
This repository does not have a README...
NTDLLReflection
NTDLLReflection Bypass Userland EDR hooks by Loading Reflective Ntdll in memory from a remote server based on Windows ReleaseID to avoid opening a handle to ntdll , and trigger exported APIs from the export table...
PE-Obfuscator
PE-Obfuscator Evasionを考慮したPE難読化ツールです。RTCore64ドライバーを読み込むには 管理者権限 が必要です。 ビデオ: https://user-images.githubusercontent.com/123980007/234171901-c1eb735e-ceca-481d-9310-02ba30f6836b.mp4 難読化ツール: - リモートサーバーからXORされたFileless PEを取得する - ローダーをディスクにドロップする - そのローダーにランダムなセクションを追加する - 新しく作成したローダーセクションにXORされたFilele...
Fuck-Etw
「⚙️」ETWバイパス & Ntdllアンフッキング Event Trace WindowsETWをバイパスし、ntdllのフックを解除します。 |\ /| | \ /\ \ /|\ /| | /| || /| \ / /| / | | | | | | || | | / / | | | | | | | | | | | || | | | | | | | | | | | | | || | | \ \ | | | | || || | | | || /| / \ | /\ | | | | |/ /|/ // Made by sorahed v1.0 i Hooked Ntdll...
CallstackSpoofingPOC
Callstack spoofing + Indirect Syscalls POC This project consists of a simple C++ self-Injecting dropper focused on EDR evasion POC. To implement it, I have combined the use of Windows Thread Pooling to hide the call stack and the use of indirect syscalls to avoid hooking in the NTDLL...
LdrLibraryEx
LdrLibraryEx A small x64 library to load dll's into memory. Features low dependencies & function use only ntdll.dll used position independent code lightweight and minimal easy to use load modules from memory load modules from disk api sets support bypass image load callbacks using private memory...
RefleXXion
Introduction RefleXXion is a utility designed to aid in bypassing user-mode hooks utilised by AV/EPP/EDR etc. In order to bypass the user-mode hooks, it first collects the syscall numbers of the NtOpenFile, NtCreateSection, NtOpenSection and NtMapViewOfSection found in the LdrpThunkSignature arra...
voidsyscall
voidsyscall English | 简体中文 | 조선어 | Русский Zero WinAPI. Every NT primitive resolved at runtime from ntdll in memory — SYSCALL instructions issued directly via Plan9 assembly stubs, no import table, no ntdll usermode hooks touched. C2 over HTTPS / DNS / ICMP, AES-256-GCM per message. Windows nativ...
CVE-2019-12899
Delta Electronics DeviceNet Builder 2.04 has a User Mode Write AV starting at ntdll!RtlQueueWorkItem+0x00000000000005e3...
