
DLLHSC
Automated scanner for discovering DLL search order hijacking candidates in Windows executables, featuring import table parsing, runtime module…

Automated scanner for discovering DLL search order hijacking candidates in Windows executables, featuring import table parsing, runtime module…

Robber is open source tool for finding executables prone to DLL hijacking

Windows privilege escalation discovery tool that parses Process Monitor boot logs to identify DLL hijacking, weak ACLs, and other elevation paths,…

Lightweight native Windows memory scanner for AV/EDR platforms, detecting suspicious mapped images and manual DLL injection techniques by IAT thunk

Automated DLL hijacking vulnerability discovery tool that analyzes PE binaries at load-time and runtime via API hooking, enumerating missing DLLs and…

DLLirant is a tool to automatize the DLL Hijacking researches on a specified binary.

DLLirant is a tool to automatize the DLL Hijacking researches on a specified binary.

ExportHider: Generating Export Table during Runtime to Hide the Exported Functions from the DLL File.

A small tool I made to dump the export table of PE files. The primary use case was intended for use within DLL proxying.

Mangle is a tool that manipulates aspects of compiled executables (.exe or DLL) to avoid detection from EDRs

A desktop tool that allows injecting DLLs, hooking WinAPI functions like CreateFileW, and modifying process behavior at runtime — designed for…

Disassemble ANY files including .so (NDK, JNI), Windows PE(EXE, DLL, SYS, etc), linux binaries, libraries, and any other files such as pictures,…

DLL Hijacking in Quickheal Total Security/ Internet Security/ Antivirus Pro (Installers)

SigFlip is a tool for patching authenticode signed PE files (exe, dll, sys ..etc) without invalidating or breaking the existing signature.

find dll base addresses without PEB WALK

IDA python script for deobfuscating Astaroth/Guildma injector DLL

DLL sideloading/proxying with Nim!