74 skills found · Page 1 of 3
outflanknl / DumpertLSASS memory dumper using direct system calls and API unhooking.
GetRektBoy724 / SharpUnhookerC# Based Universal API Unhooker
mgeeky / UnhookMeUnhookMe is an universal Windows API resolver & unhooker addressing problem of invoking unmonitored system calls from within of your Red Teams malware
timwhitez / Doge GabhGetProcAddressByHash/remap/full dll unhooking/Tartaru's Gate/Spoofing Gate/universal/Perun's Fart/Spoofing-Gate/EGG/RecycledGate/syswhisper/RefleXXion golang implementation
CylanceVulnResearch / ReflectiveDLLRefresherUniversal Unhooking
SaadAhla / UnhookingPatchBypass EDR Hooks by patching NT API stub, and resolving SSNs and syscall instructions at runtime
hwbp / CLR UnhookModern security products (CrowdStrike, Bitdefender, SentinelOne, etc.) hook the nLoadImage function inside clr.dll to intercept and scan in-memory .NET assembly loads. This tool unhooks that function.
SaadAhla / Ntdlll Unhooking Collectiondifferent ntdll unhooking techniques : unhooking ntdll from disk, from KnownDlls, from suspended process, from remote server (fileless)
reveng007 / ReflectiveNtdllA Dropper POC with a focus on aiding in EDR evasion, NTDLL Unhooking followed by loading ntdll in-memory, which is present as shellcode (using pe2shc by @hasherezade). Payload encryption via SystemFucntion033 NtApi and No new thread via Fiber
zimnyaa / NoWatchImplant drop-in for EDR testing
ars3n11 / MineSweeperWindows user-land hooks manipulation tool.
Signal-Labs / Iat Unhook Sample(First Public?) Sample of unhooking ntdll (All Exports & IAT imports) hooks in Rust using in-memory disassembly, avoiding direct syscalls and all hooked functions (incl. hooked NtProtectVirtualMemory)
trickster0 / LdrLoadDll UnhookingLdrLoadDll Unhooking
plackyhacker / Peruns FartPerun's Fart (Slavic God's Luck). Another method for unhooking AV and EDR, this is my C# version.
unkvolism / Fuck EtwBypass the Event Trace Windows(ETW) and unhook ntdll.
frkngksl / CelebornUserland API Unhooker Project
S3N4T0R-0X0 / HunterОхотник (Hunter) is a simple Adversary Simulation tool developed for achieves stealth through API unhooking, direct and indirect syscalls, Event Tracing for Windows (ETW) suppression, process hollowing, stack spoofing, polymorphic encryption, and comprehensive anti-analysis mechanisms.
XaFF-XaFF / ZwProcessHollowingZwProcessHollowing is a x64 process hollowing project which uses direct systemcalls, dll unhooking and RC4 payload decryption
eversinc33 / MalwareAdventurezMy adventures in learning about different userland malware techniques, such as syscalls, injection, unhooking or sandbox evasion.
MaorSabag / Paruns FartJust another ntdll unhooking using Parun's Fart technique
