SILVERPICK

SILVERPICK VERSION v1.1 BRIEF Project SILVERPICK is a Windows User-Mode Shellcode Development Framework WUMSDF whose sole purpose is to empower capability developers to build Position Independent Code PIC blobs for Windows x64 using C/C++ in an easy manner so as to reduce the development costs of...

patching

Patching - Interactive Binary Patching for IDA Pro Overview Patching assembly code to change the behavior of an existing program is not uncommon in malware analysis, software reverse engineering, and broader domains of security research. This project extends the popular IDA Pro disassembler to...

MsSettingsDelegateExecute

MsSettingsDelegateExecute Bypass UAC on Windows 10/11 x64 using ms-settings DelegateExecute registry key. This visual studio project will compile a static x64 binary to test this issue. License These files are available under the 3-clause BSD license...

ghidra_stack_strings

Ghidra Stack-strings A script to detect stack-strings written by the selected x86/x64 instructions, emulated using Unicorn. The script is written in Python 3, so it needs Ghidrathon...

VectorKernel

VectorKernel PoCs for Kernelmode rootkit techniques research or education. Currently focusing on Windows OS. All modules support x64 family 64bit OS only. Environment All modules are tested in Windows 11 x64. To test drivers, following options can be used for the testing machine: 1. Enable Loadin...

DeepSleep

DeepSleep A variant of Gargoyle for x64 to hide memory artifacts using ROP only and PIC. Huge thanks to @waldoirc for documenting large parts of this technique on his blog This implementation is different in that it does not make use of any APCs and is fully implemented as PIC. Description I have...

Fritter

Fritter The evasive cousin of Donut. Fritter is a heavily modified fork of TheWover and Odzhan's Donut shellcode generator. It generates position-independent shellcode for in-memory execution of VBScript, JScript, EXE, DLL, and .NET assemblies, with a focus on evasion and signature resistance. Th...

Chaos-Rootkit

Chaos-Rootkit Chaos-Rootkit is an x64 Ring 0 rootkit i wrote to better understand kernel internals and rootkit techniques. Gui version Features Hide process: This feature allows you to hide processes from listing tools via DKOM. Elevate specific process privileges : This feature enables you to...

Phantom-Evasion-Loader

SROP-Assisted Cross-Memory Attach CMA Injection via Direct Syscalls. 👻 Phantom-Evasion-Loader x64 Linux Phantom-Evasion-Loader is a standalone, pure x64 Assembly injection engine engineered to minimize the detection surface of modern EDR/XDR solutions and Kernel-level monitors like Falco eBPF. It...

windbg-decompile-ext

Windbg Decompile Extension via LLM This project is a Windows x64 WinDbg extension skeleton that resolves a function by name or address, reconstructs a deterministic control-flow view, and asks an LLM directly from the extension to produce pseudocode. Layout src/extension: WinDbg extension DLL and...

IronPE

IronPE - Minimal Windows PE manual loader written in Rust. Rust PE Loader / Manual Mapping Implementation IronPE is a minimal Windows PE manual loader written in Rust for both x86 and x64 PE files. This project is a Rust reimplementation of my previous project dotNetPELoader , which implemented a...

RustChain

Description This tool is a simple PoC of how to hide memory artifacts using a ROP chain in combination with hardware breakpoints. The ROP chain will change the main module memory page's protections to N/A while sleeping i.e. when the function Sleep is called. For more detailed information about...

makin

I create makin to make initial malware assessment little bit easier for me, I think it's useful for others as well, It helps to reveal a debugger detection techniques used by a sample. Any feedback is greatly appreciated: @qazqaz How does it work? makin opens a sample as a debuggee and injects...

ida_ifl

IFL - Interactive Functions List License: CC-BY https://creativecommons.org/licenses/by/3.0/ A small plugin with a goal to provide user-friendly way to navigate between functions and their references. Additionally, it allows to import reports generated by i.e. PE-sieve into IDA. Supports: .tag...

upx

ooooo ooo ooooooooo. ooooooo ooooo 888' 8' 888 Y88. 8888 d8' 888 8 888 .d88' Y888..8P 888 8 888ooo88P' 8888' 888 8 888 .8PY888. 88. .8' 888 d8' 888b YbodP' o888o o888o o88888o The Ultimate Packer for eXecutables Copyright c 1996-2026 Markus Oberhumer, Laszlo Molnar & John Reiser...

barf-project

BARF : Binary Analysis and Reverse engineering Framework The analysis of binary code is a crucial activity in many areas of the computer sciences and software engineering disciplines ranging from software security and program analysis to reverse engineering. Manual binary analysis is a difficult...

NovaHypervisor

NovaHypervisor Description NovaHypervisor is a defensive x64 Intel host based hypervisor. The goal of this project is to protect against kernel based attacks either via Bring Your Own Vulnerable Driver BYOVD or other means by safeguarding defense products AntiVirus / Endpoint Protection and kerne...

cve-2018-8120

cve-2018-8120 Details see: http://bigric3.blogspot.com/2018/05/cve-2018-8120-analysis-and-exploit.html...

r2frida

r2frida Radare2 and Frida better together Description Self-contained plugin for radare2 that ships frida and allows to instrument local or remote processes using r2 commands instead but not limited to Frida scripts. The radare project provides a complete toolchain for reverse engineering, it's...

TrollDump

TrollDump Injects x64 managed DLL into x64 managed/unmanaged process process must have GUI because we obtain its windows handle using setwindowshook Here as a TROLL, we inject into hidden window taskmgr to do a lsass dump undetected see Test Case section below The injector DLL and injected DLL is...