
mwemu
Pure Rust x86 hardware emulator and Windows process simulator for malware analysis, shellcode emulation, and payload unpacking. Supports 32/64-bit PE…

Pure Rust x86 hardware emulator and Windows process simulator for malware analysis, shellcode emulation, and payload unpacking. Supports 32/64-bit PE…

Fileless x64 Assembly C2 framework with dual-channel ICMP/DNS protocol pivoting, direct syscall execution, and ptrace-based process injection for…

P³-Shellcode Loader is a loader that implements a code injection technique which leverages the Process Parameters structure as an execution and…

Windows memory-forensics and threat hunting tool that scans live process memory for malicious patterns, injection techniques, and reflectively loaded…

PoCs and tools for investigation of Windows process execution techniques

BOF to run PE in Cobalt Strike Beacon without console creation

Nim-based process hollowing loader for PE executables with configurable injection methods, direct/indirect syscalls, anti-debug, payload encryption,…

Hijacks code execution via overwriting Control Flow Guard pointers in combase.dll

A technique to run binaries filelessly and stealthily on Linux by "overwriting" the shell's process with another.

Inject a shared library (i.e. arbitrary code) into a live linux process, without ptrace

Proof-of-concept exploit for CVE-2024-0311 bypassing Skyhigh Client Proxy policy via process injection and named pipe manipulation, with custom…

Threadless Process Injection using remote function hooking.

Simple POC library to execute arbitrary calls proxying them via NdrServerCall2 or similar


My experiments in weaponizing Nim (https://nim-lang.org/)

Windows x64 handcrafted token stealing kernel-mode shellcode

Dynamically convert an unmanaged EXE or DLL file to PIC shellcode by prepending a shellcode stub.

CVE-2024-24576 Proof of Concept