
NTDLL-reconstruction
A technique that mixes NTDLL unhooking and hellsgate gate varients

A technique that mixes NTDLL unhooking and hellsgate gate varients

Clean Indirect Syscalls with Syscall Tampering.

Detection reverse shell and kill it before trying shell.

BYOVD: Use 360 WFP driver to block EDR/XDR network connection.

Anti Virtulization, Anti Debugging, AntiVM, Anti Virtual Machine, Anti Debug, Anti Sandboxie, Anti Sandbox, VM Detect package. Windows ONLY.

Endpoint behavior monitoring and analysis system for processes, files, registry, and networks. Supports scripting, extensions, and plugins for…

Proof-of-concept exploit for CVE-2024-0311 bypassing Skyhigh Client Proxy policy via process injection and named pipe manipulation, with custom…

Exploit for redirecting control flow of a legit kernel module to your own illegitimate kernel module to evade anti-cheats stack walking

HyperDeceit is the ultimate all-in-one library that emulates Hyper-V for Windows, giving you the ability to intercept and manipulate operating system…

C++ shellcode injection technique using XOR encryption and UUID string conversion to bypass Windows Defender, with function call obfuscation and…

It encrypts the text section and set the protection to NO_ACCESS.

Lists of AMSI triggers (VBA, JScript / VBScript)

Reflective DLL that scans process memory and unhooks loaded libraries to evade security software, with UPX, TLS injector, and Meterpreter integration.

Patching ROP-encoded shellcodes into PEs

Platform independent peCloak fork based on Capstone