shcesama/cve-2023-4863-analysisEducational analysis of CVE-2023-4863 (libwebp heap buffer overflow) with Blue Team detection tools, static WebP scanner, defensive Java validator,…
withsecurelabs/ticktockEnumerates Windows timer-queue timers to detect Ekko sleep obfuscation, aiding memory forensics and malware analysis in identifying evasive…
joe-desimone/patriotIn-memory stealth detection tool that identifies process hollowing, module stomping, unbacked executable regions, and anomalous CONTEXT structures…
awnumar/memguardSoftware sandbox for storage of sensitive information in memory.
codewhitesec/handlekatzPIC-based Lsass memory dumper using cloned handles to evade detection, producing obfuscated dumps with minimal memory footprint for red team…
bl4ckm1rror/fud-uuid-shellcodeC++ shellcode injection technique using XOR encryption and UUID string conversion to bypass Windows Defender, with function call obfuscation and…
nccgroup/windowsmempagedeltaA Microsoft Windows service to provide telemetry on Windows executable memory page changes to facilitate threat detection
aarif450/zapscapeGuest-to-host KVM/x86 escape exploiting CVE-2026-64561, delivering a full PoC chain and analysis for security researchers.
gmh5225/evilkasperskyWindows kernel driver experiment based on KasperskyHook that uses direct syscalls for interprocess memory copying, with support for unloading the…
racoten/reflectivepluginloaderA minimal PE mapper that loads DLLs straight from memory and calls into a clean plugin interface, no LoadLibrary needed.
adeadukagi/cve-2023-32233-reproductionReproduction and root-cause analysis of CVE-2023-32233, a Linux kernel nf_tables use-after-free enabling local privilege escalation, with PoC and…
yulisec/cve-2025-7771Full exploit chain for CVE-2025-7771 in ThrottleStop.sys, abusing unvalidated physical memory R/W IOCTLs to escalate from administrator to SYSTEM on…
marcosd4h/memhunterLive hunting of code injection techniques
kondordevsecuritycorp/cve-2025-60709Windows CLFS LPE exploit PoC for security research
jthuraisamy/syswhispers2AV/EDR evasion via direct system calls.
orange-cyberdefense/p3-loaderP³-Shellcode Loader is a loader that implements a code injection technique which leverages the Process Parameters structure as an execution and…
malvuln/ransomlordRansomLord is a proof-of-concept Anti-Ransomware exploitation tool that automates the creation of PE files, used to compromise ransomware…
elfmaster/mayaHighly advanced Linux anti-exploitation and anti-tamper binary protector for ELF.
