guapizhu Goto Github PK

al-khaser

Public malware techniques used in the wild: Virtual Machine, Emulation, Debuggers, Sandbox detection.

atomic-red-team

Small and highly portable detection tests based on MITRE's ATT&CK.

autochk-rootkit

Reverse engineered source code of the autochk rootkit

awesome-rat

RAT And C&C Resources. 250+ Open Source Projects, 1200+ RAT/C&C blog/video.

blacklotus

BlackLotus UEFI Windows Bootkit

callstack-spoofer

This tool will allow you to spoof the return addresses of your functions as well as system functions.

doublepulsar-usermode-injector

A utility to use the usermode shellcode from the DOUBLEPULSAR payload to reflectively load an arbitrary DLL into another process, for use in testing detection techniques or other security research.

ducksandboxdetect

沙箱测试,测评国内常见沙箱的代码与结论

dumpext

WinDbg debugger extension library providing various tools to analyse, dump and fix (restore) Microsoft Portable Executable files for both 32 (PE) and 64-bit (PE+) platforms.

evilclippy

A cross-platform assistant for creating malicious MS Office documents. Can hide VBA macros, stomp VBA code (via P-Code) and confuse macro analysis tools. Runs on Linux, OSX and Windows.

free-api

收集免费的接口服务,做一个api的搬运工

guapizhu.github.io

hackertools

使用MFC编写的病毒技术合集

hidedriver

之前那份是7600的，每次编译搞得好麻烦。更新一个VS2017可以直接编译的。

injectallthethings

Seven different DLL injection techniques in one single project.

libpeconv

A library to load, manipulate, dump PE files. See also: https://github.com/hasherezade/libpeconv_tpl

malware

malware source codes

malwaresourcecode

Collection of malware source code for a variety of platforms in an array of different programming languages.

matrixlib

一个基于模板的C++矩阵运算库，简单易用，支持加减乘除转置求逆等常用运算. A template based C++ matrix operation library, which is simple and easy to use, and supports common operations such as addition, subtraction, multiplication and division, transposition and inversion.

memorymodule

Library to load a DLL from memory.

mywheel

自己造轮子，不会造找代码造

nativelib

涵盖了了几乎全部的用户模式可用的NT本机API和Windows窗口站API的声明与定义

newhidedriverex

Hide Driver By MiProcessLoaderEntry

pelauncher

Portable Executable launcher for Windows NT bypassing loader

rcedit

Command line tool to edit resources of exe

simpleremoter

基于gh0st的远程控制器：实现了终端管理、进程管理、窗口管理、远程桌面、文件管理、语音管理、视频管理、服务管理、注册表管理等功能，优化全部代码及整理排版，修复内存泄漏缺陷，程序运行稳定。此项目初版见：https://github.com/zibility/Remote

spectre

A Windows kernel-mode rootkit that abuses legitimate communication channels to control a machine.

windows-driver-samples

This repo contains driver samples prepared for use with Microsoft Visual Studio and the Windows Driver Kit (WDK). It contains both Universal Windows Driver and desktop-only driver samples.

windows-kernel-programing

Windows-Kernel-Programing