
NativeMirror
Native Delphi implementation of PE-sieve functionality with a reusable library, CLI, and PE-sieve-compatible DLL for HollowsHunter integration.

Native Delphi implementation of PE-sieve functionality with a reusable library, CLI, and PE-sieve-compatible DLL for HollowsHunter integration.

Abuses the Microsoft-signed tlscsp.dll LOLBin to run RC4 encrypt/decrypt via LsCsp_EncryptHwid, patching the hardcoded key in memory for BYOK…

C++ library to load DLLs directly from memory without touching disk, with exception handling support, enabling stealthy code execution and evasion of…

SketchUp Desktop 2025 DLL Hijacking Vulnerability

Research and proof-of-concept for CVE-2026-25676, a DLL search path hijacking vulnerability in M-Track Duo HD installer, including root cause…

Debugger utilizing stealth hooks to hide from debugger detection

Simple Anti-cheat library for applications that use C++ on windows. #PastedProtection

A small tool I made to dump the export table of PE files. The primary use case was intended for use within DLL proxying.

Exploiting the .lnk vulnerability and operating system handling mechanisms regarding explorer.exe and USB drives.

Simulates the Windows PE loader to identify DLL hijacking vulnerabilities, generates weaponized DLLs with shellcode payloads, and detects UAC…

IDA python script for deobfuscating Astaroth/Guildma injector DLL

DLLirant is a tool to automatize the DLL Hijacking researches on a specified binary.

A reference of Windows API function calls, including functions for file operations, process management, memory management, thread management,…

Generate a proxy dll for arbitrary dll

Practical Windows malware development course: API hashing, DLL sideloading, shellcode execution, PE manipulation, payload hosting, and delivery labs.

find dll base addresses without PEB WALK

DLL sideloading/proxying with Nim!

DLL Hijacking in Quickheal Total Security/ Internet Security/ Antivirus Pro (Installers)