poolmonxv2

Kernel Pool Monitor

ppl

run process as PPL Antimalware (ELAM)

psnotifroutineunloader

This script is used to unload PsSetCreateProcessNotifyRoutineEx, PsSetCreateProcessNotifyRoutine, PsSetLoadImageNotifyRoutine and PsSetCreateThreadNotifyRoutine from ESET Security to bypass the driver detection

pte-view

py

飘云ark（pyark）

reactos

realblindingedr

Remove AV/EDR Kernel ObRegisterCallbacks、CmRegisterCallback、MiniFilter Callback、PsSetCreateProcessNotifyRoutine Callback、PsSetCreateThreadNotifyRoutine Callback、PsSetLoadImageNotifyRoutine Callback...

ring0-injector

Kernel Cheat Injector supports all game engines, bypass all anti-cheats | EAC EMULATOR

rw_socket_driver

Driver that uses network sockets to communicate with client and read/ write protected process memory.

salient-rootkit

A kernel mode Windows rootkit in development.

sdk71examples

sdk Examples

shark

Turn off PatchGuard in real time for win7 (7600) ~ later

shothv

ShotHv

simple-mmcopymemory-hook

A simple MmCopyMemory hook.

stealthy-kernelmode-injector

Manual mapper that uses PTE manipulation, Virtual Address Descriptor (VAD) manipulation, and forceful memory allocation to hide executable pages. (VAD hide / NX bit swapping)

symlinkprotect

File system minifilter driver for Windows to block symbolic link attacks.

sysmoneop

system_trace_tool

内核驱动加载/卸载痕迹清理,努力绕过反作弊吧 PiDDBCacheTable and MmLastUnloadedDriver

systemexplorer

Windows System Explorer

tdl

Driver loader for bypassing Windows x64 Driver Signature Enforcement

telemetrysourcerer

Enumerate and disable common sources of telemetry used by AV/EDR.

titanhide

Hiding kernel-driver for x86/x64.

tokenizer

Kernel Mode Driver for Elevating Process Privileges

tokenplayer

Manipulating and Abusing Windows Access Tokens.

udis86

Disassembler Library for x86 and x86-64

unkover

PoC Anti-Rootkit to uncover Windows Drivers/Rootkits mapped to Kernel Memory.

virtualfilesystem

Playing with Projected File System 监视文件操作

vmwarethrough

wdk_template

Windows kernel driver template for cmkr (with testsigning).

wdm

Windows Driver Model (WDM)