laZzzy

laZzzy laZzzy is a shellcode loader that demonstrates different execution techniques commonly employed by malware. laZzzy was developed using different open-source header-only libraries. Features Direct syscalls and native Nt functions not all functions but most Import Address Table IAT evasion...

antidbg

AntiDBG antidbg is a x64 user-mode anti-debugging library for Windows, designed to protect software from debugging. Consider the library as a base for your anti-debugging protection, not as your only defense. The library is: Very easy to use only one function call required. Designed for high...

rust_syscalls

RUSTSYSCALLS Single stub direct and indirect syscalling with runtime SSN resolving for windows. Features: One single line for all your syscalls Function name hashing at compilation time Direct or indirect sycalls x8664, WOW64 and x86 native support Designed to allow the implementation of custom S...

dd

dd Run Linux containers on macOS — with no VM. What is dd? dd runs Linux containers natively on Apple-Silicon macOS without a virtual machine. There is no Linux kernel and no hypervisor underneath: a JIT translates the container's code and services its Linux syscalls in userspace the gVisor / PRo...

RToolZ

RToolZ A Stealthy Lsass Dumper - can abuse ProcExp152.sys driver to dump PPL Lsass. What Is So Special About It? No calls to MiniDump or any dbghelp.lib methods, all of the dumping process is done MANUALLY by the dumper while reducing the dump size to minimal by removing unessacery DLLs. Methods ...

DInvoke_rs

DInvokers Rust port of Dinvoke. DInvokers may be used for many purposes such as PE parsing, dynamic exported functions resolution, dynamically loading PE plugins at runtime, API hooks evasion and more. Features: Dynamically resolve and invoke undocumented Windows APIs from Rust. Primitives allowi...

ROP_ROCKET

Introducing the ROP ROCKET This new, advanced ROP framework made it debute at at DEF CON 31 with some unprecedented capabilities. ROCKET generates several types of chains, and it provides new patterns or techniques. Please note that this is still a work in progress, with some updated and enhanced...

keystone

Keystone Engine Keystone is a lightweight multi-platform, multi-architecture assembler framework. It offers some unparalleled features: Multi-architecture, with support for Arm, Arm64 AArch64/Armv8, Ethereum Virtual Machine, Hexagon, Mips, PowerPC, RISC-V, Sparc, SystemZ & X86 include 16/32/64bit...

nimcrypt

nimcrypt Nimcrypt is a .NET PE Crypter written in Nim, based entirely on the work of @byt3bl33d3r's OffensiveNim project: https://github.com/byt3bl33d3r/OffensiveNim This tool was inspired by @S3cur3Th1sSh1t's blog post a few months ago, as it's essentially just a full PoC of what he presented:...

HWSyscalls

HWSyscalls Main Contributors Description HWSyscalls is a new method to execute indirect syscalls using 3 main components: Hardware breakpoints and Vectored Exception Handler to control the flow of execution. HalosGate is used to find syscall numbers and addresses. Creating a synthetic trampoline ...

CallstackSpoofingPOC

Callstack spoofing + Indirect Syscalls POC This project consists of a simple C++ self-Injecting dropper focused on EDR evasion POC. To implement it, I have combined the use of Windows Thread Pooling to hide the call stack and the use of indirect syscalls to avoid hooking in the NTDLL...

DEFCON-31-Syscalls-Workshop

Indirect Syscalls: A journey from high to low RedOps | Red Team Village | DEF CON 31 Getting Started All the theory and playbooks for the exercises can be found in the wiki, which together with the prepared POCs is the heart of this project. The POCs for the exercises can be found here on the mai...

CVE-2026-46333

CVE-2026-46333 Research and educational repository for CVE-2026-46333 , focused on reproducible analysis and a safe test PoC workflow. 1 CVE-2026-46333 This project documents the vulnerability behavior, test setup, and validation approach so researchers and defenders can reproduce findings...

NullGate

NullGate This project implements a comfortable and modern way to use the NTAPI functions using indirect syscalls, coupled with the FreshyCalls method with a little twist for dynamic syscall number retrieval. It also uses a technique that I haven't seen being mentioned to bypass windows defender's...

EvilKaspersky

This is an old experiment I did year ago and now just saw the repo and decided to make it public. It is KasperkyHook, but the syscalls directly point onto functions useful for interprocess memory copying. You can fully unload the control driver afterwards and erase its memory. Another advantage i...

SyscallRevenant

Surpassing EDRs & AVs SyscallRevenant SyscallRevenant is a new method of performing clean indirect syscalls. The main component resolves System Service Numbers SSNs and syscall instruction addresses dynamically. This is done by enabling the trap flag during execution. The secondary component is...

nim-loader

nim-loader un proyecto muy tosco y en progreso de aventura aprendiendo nim combinando recursos para crear un cargador de shellcode que implementa técnicas comunes de evasión de EDR/AV. ¡Esto es un desastre y es solo con fines de investigación! Por favor, no esperes que compile y se ejecute sin tu...

rust_syscalls

RUSTSYSCALLS Stub singolo per syscall dirette e indirette con risoluzione runtime degli SSN per Windows. Caratteristiche: Una singola riga per tutte le tue syscall Hashing dei nomi delle funzioni in fase di compilazione Syscall dirette o indirette Supporto nativo per x8664, WOW64 e x86 Progettato...

A Resource-Aware Behavior Reconstruction and Hierarchical Semantic Learning Framework for Host Intrusion Detection

System calls syscalls record key interactions between running programs and the operating system kernel, providing fine-grained and minimally intrusive data for host-based intrusion detection systems HIDS deployed in cloud and other modern computing environments. However, existing methods often...

Rocky Linux 8 [CIQ] Security Update: flatpak / flatpak-debuginfo / flatpak-debugsource / flatpak-libs / etc (crlsa-2021_4042)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20214042 advisory. flatpak: Sandbox bypass via recent VFS-manipulating syscalls CVE-2021-41133 Tenable has extracted the preceding description block directly from the CIQ security...