acheron

About Acheron is a library inspired by SysWhisper3/FreshyCalls/RecycledGate, with most of the functionality implemented in Go assembly. acheron package can be used to add indirect syscall capabilities to your Golang tradecraft, to bypass AV/EDRs that makes use of usermode hooks and instrumentatio...

seccomp-tools

Seccomp Tools Powerful tools for seccomp analysis. This project is aimed primarily but not exclusively at analyzing seccomp sandboxes in CTF pwn challenges. Some features are CTF-specific, but they're just as useful for analyzing real-world seccomp filters. Features Dump - Automatically dumps...

HallWatch

HallWatch Copyright C 2026 Adam Zypherion — licensed under GPL-3.0. Indirect syscalls are simple once you have seen one. The loader walks ntdll, reads the SSN out of Nt prologue, finds the 0F 05 two bytes further in, sets r10/rax/rdx/r8/r9 itself, and jmps straight at those two bytes. The syscall...

exrop

Exrop Automatic ROP chain generator for x86-64 binaries, powered by Triton symbolic execution. Features Set registers to constants or other registers rdi=0x41414141, rdi=rax Write to memory constant and register-based addresses/values Write strings/bytes to memory Function calls with mixed...

kafel

WHAT IS IT? Kafel is a language and library for specifying syscall filtering policies. The policies are compiled into BPF code that can be used with seccomp-filter. This is NOT an official Google product. Usage With verbose error reporting root@kitploit: struct sockfprog prog; kafelctxtt ctxt =...

CVE-2017-5123

CVE-2017-5123 Linux privilege escalation exploiting waitid syscall. The exploit is brought to you by @XeR0x2A and @chaignc from HexpressoTeam for educational purposes only. The bug was introduced the 2017-05-21 and fixed 2017-10-09, 4.14.0-rc4+ is known vulnerable. asciicast If you have a...

windiff

WinDiff About WinDiff is an open-source web-based tool that allows browsing and comparing symbol, type and syscall information of Microsoft Windows binaries across different versions of the operating system. The binary database is automatically updated to include information from the latest Windo...

SysWhispers2

SysWhispers2 SysWhispers helps with evasion by generating header/ASM files implants can use to make direct system calls. All core syscalls are supported and example generated files available in the example-output/ folder. Difference Between SysWhispers 1 and 2 The usage is almost identical to...

CVE-2022-0185

CVE-2022-0185 Linux Kernel Privilege Escalation Escape toc Vulnerability Overview Vulnerability ID: CVE-2022-0185 CVSS Score: Affected Product: linux kernel - fsconfig syscall Affected Versions: linux kernel 5.1-rc1 5.16.2 Exploitation Requirements: Linux local; requires CAPSYSADMIN capability ca...

goBox

goBox GO sandbox to run untrusted code. goBox uses Ptrace to hook into READ syscalls, giving you the option to accept or deny syscalls before they are executed. Usage root@kitploit: Usage of ./gobox: gobox FLAGS command flags: -h Print Usage. -n value A glob pattern for automatically blocking fil...

strace

strace - Linux 系统调用跟踪器 这是 strace —— 一款用于 Linux 的诊断、调试和教学型用户空间工具，具有传统的命令行界面。它用于监控和篡改进程与 Linux 内核之间的交互，包括系统调用、信号传递以及进程状态的变更。strace 的运行依赖于名为 ptrace 的内核特性。 strace 依据 GNU 宽通用公共许可证 2.1 或更高版本 发布；详情请参阅 COPYING 文件。 strace 测试套件依据 GNU 通用公共许可证 2 或更高版本 发布；详情请参阅 tests/COPYING 文件。 关于近期版本的变更信息，请参阅 NEWS 文件。 文档...

strace

strace - the linux syscall tracer This is strace -- a diagnostic, debugging and instructional userspace utility with a traditional command-line interface for Linux. It is used to monitor and tamper with interactions between processes and the Linux kernel, which include system calls, signal...

NimGetSyscallStub

NimGetSyscallStub Get fresh Syscalls from a fresh ntdll.dll copy. This code can be used as an alternative to the already published awesome tools NimlineWhispers and NimlineWhispers2 by @ajpc500 or ParallelNimcalls. The advantage of grabbing Syscalls dynamically is, that the signature of the Stubs...

ShellCodeEmulator

Windows shellcode emulation tool based upon unicorn framework. ShellcodeEmulator emulates Windows shellcode with the help of windbg process memory dumps. You can provide shellcode to analyze with any Windows process dump image. The tool will emulate as much as of the userland code using the...

instrumentation_callbacks

instrumentationcallbacks Instrumentation callbacks are quite a fun undocumented part of Windows. All the code in this repository is released under the MIT license. This repository uses google style C++ spacing. PRs are welcome if you find issues, bugs, or believe a specific feature should be adde...

krf

KRF KRF 是一个内 核态随 机错 误注入器。 目前支持 Linux 和 FreeBSD 内核。 是什么？ 故障注入 是一种软件测试技术，通过在被测程序所调用的函数中诱发失败（“故障”）来工作。如果被调用方未能进行正确的错误检查和处理，这些故障可能导致不可靠的应用行为或可被利用的漏洞。 与现有的许多用户态故障注入系统不同，KRF 通过加载的内核模块在内核态运行。这有几个优点： 它适用于静态链接的二进制文件，因为不依赖 LDPRELOAD 进行注入。 由于它拦截的是原始的系统调用而非它们的 libc 包装函数，因此可以注入通过 syscall3 或内联汇编发起的调用。 它可能比使用...

shellnoob

ShellNoob Writing shellcodes has always been super fun, but some parts are extremely boring and error prone. Focus only on the fun part, and use ShellNoob! For a quick overview, check the slides for the Black Hat Arsenal talk: link Want to contribute? Feature request? Bug report? Swears? All...

ansvif

ansvif 一个不太智能的模糊测试器 Marshall Whittaker oxagast [email protected] 随着系统复杂性的增加，该系统内出现问题的可能性也随之增加。 --惠特克定律 编译依赖： automake autoconf-archive zlib1g-dev g++ gcc （如果要支持GTK则需要libgtk2.0-dev） 编译： Linux： root@kitploit: $ aclocal && autoconf && automake -a && ./configure && make && make check...

RedTeamCCode

RedTeamCCode Repositorio de código C de Red Team ¿Quieres saber qué ID de syscall se utiliza en tu sistema? root@kitploit: getsyscall.exe ntdll.dll NtProtectVirtualMemory ntdll.dll!NtProtectVirtualMemory at 0x00007FFDE568D010 NtProtectVirtualMemory syscall ID 0x00000050 80 APIs de ntdll.dll con...

RecycledInjector

RecycledInjector Description Currently Fully Undetected same-process native/.NET assembly shellcode injector based on RecycledGate by thefLink, which is also based on HellsGate + HalosGate + TartarusGate to ensure undetectable native syscalls even if one technique fails. To remain stealthy and ke...