
memory-relocalloc
C proof-of-concept that locates code caves in the .reloc section of mapped DLLs to allocate and execute small shellcode, replacing typical memory…

C proof-of-concept that locates code caves in the .reloc section of mapped DLLs to allocate and execute small shellcode, replacing typical memory…

A technique that mixes NTDLL unhooking and hellsgate gate varients

LLVM-native binary analysis and emulation platform that lifts AArch64 and x86_64 machine code to LLVM IR for instrumentation, deobfuscation, and…

Windows kernel driver utility that abuses vulnerable signed drivers (BYOVD) to bypass DSE, load unsigned drivers, hijack protected processes, and…

Interactive GDB walkthrough of the House of Apple 2 FSOP technique on glibc 2.43, with a reproducible sandbox covering vtable bypass, stack pivoting,…

Forth-based compiler deployed as position-independent x86_64 shellcode, providing a remote code execution agent with interactive REPL over TCP, HTTP,…

Manual kernel driver mapper for Windows x64 that abuses CVE-2025-8061 in Lenovo's LnvMSRIO.sys to perform a BYOVD attack, mapping PE64 drivers into…

Local privilege escalation exploit for MSI Dragon Center's MODAPI.sys driver, abusing unauthenticated MSR writes to bypass SMEP and gain SYSTEM.

An advanced in-memory evasion technique fluctuating shellcode's memory protection between RW/NoAccess & RX and then encrypting/decrypting its contents

CVE-2024-29943, but with wasm

Empire is a post-exploitation and adversary emulation framework that is used to aid Red Teams and Penetration Testers.

A collection of various and sundry code snippets that leverage .NET dynamic tradecraft

Apply a divide and conquer approach to bypass EDRs

This repo contains C/C++ snippets that can be handy in specific offensive scenarios.

A dynamic unpacking tool

Simple dotnet Native AOT app that uses AsmResolver to convert shellcode to PE

Simple dotnet Native AOT app that uses LibObjectFile to convert shellcode to ELF
