
Anti_suspend
Shellcode-based process protection that prevents thread suspension, blocks debugger attach, masks hardware breakpoints, and hides threads from…

Shellcode-based process protection that prevents thread suspension, blocks debugger attach, masks hardware breakpoints, and hides threads from…

A collection of various and sundry code snippets that leverage .NET dynamic tradecraft

Apply a divide and conquer approach to bypass EDRs

This repo contains C/C++ snippets that can be handy in specific offensive scenarios.

A dynamic unpacking tool

Simple dotnet Native AOT app that uses AsmResolver to convert shellcode to PE

Simple dotnet Native AOT app that uses LibObjectFile to convert shellcode to ELF


Windows 10 DLL Injector via Driver utilizing VAD and hiding the loaded driver

A technique that can be used to bypass AV/EDR memory scanners. This can be used to hide well-known and detected shellcodes (such as msfvenom) by…

Modern PIC implant for Windows (64 & 32 bit)

Evades AV and sandboxes on Windows using anti-sandbox checks, ntdll unhooking, dynamic API resolution, and multi-layer shellcode obfuscation…

A PICO for Crystal Palace that implements CLR hosting to execute a .NET assembly in memory.

Library that eases the use of indirect syscalls. Quite interesting AV/EDR bypass as PoC.

A small, null-free Windows shellcode that executes calc.exe (x86/x64, all OS/SPs)

A collection of my shellcode samples.

P³-Shellcode Loader is a loader that implements a code injection technique which leverages the Process Parameters structure as an execution and…

Android kernel exploit for CVE-2026-43499 (Futex-PI use-after-free) that gains temporary root on Xiaomi XIG04 to enable ADB. Includes automated…