
EvilKaspersky
Windows kernel driver experiment based on KasperskyHook that uses direct syscalls for interprocess memory copying, with support for unloading the…
defensive-toolsmalware-analysismemory-forensics+3
2

Windows kernel driver experiment based on KasperskyHook that uses direct syscalls for interprocess memory copying, with support for unloading the…

A python script developed to process Windows memory images based on triage type.

Windows kernel exploit for CVE-2020-17057 using palette objects with dangling data pointers, targeting type isolation bypass for privilege escalation.

Using CVE-2023-21768 to manual map kernel mode driver

PoC memory injection detection agent based on ETW, for offensive and defensive research purposes