xrv3ovl Goto Github PK

ollvm17

Obfuscation LLVM 17

ollvm18

openedr

Open EDR public repository

pastdse

DSE bypass using a leaked cert and adjusting the current clock.

peacemaker

PeaceMaker Threat Detection is a Windows kernel-based application that detects advanced techniques used by malware.

physmem_drivers

A collection of various vulnerable (mostly physical memory exposing) drivers.

pigsyscall

An implementation of an indirect system call

pinkpanther

Windows x64 handcrafted token stealing kernel-mode shellcode

ppdump-public

Protected Process (Light) Dump: Uses Zemana AntiMalware Engine To Open a Privileged Handle to a PP/PPL Process And Inject MiniDumpWriteDump() Shellcode

pplib

Elevate a process to be a protected process

precisebugs

privileger

Privileger is a tool to work with Windows Privileges

proxy-function-calls-for-etwti

The code is a pingback to the Dark Vortex blog: https://0xdarkvortex.dev/hiding-memory-allocations-from-mdatp-etwti-stack-tracing/

pte-protect

realblindingedr

Remove AV/EDR Kernel ObRegisterCallbacks、CmRegisterCallback、MiniFilter Callback、PsSetCreateProcessNotifyRoutine Callback、PsSetCreateThreadNotifyRoutine Callback、PsSetLoadImageNotifyRoutine Callback...

rebirthguard

Anti-cheat library for Windows C++

rhaast

doesnt work and wont work on it anymore

rippl

RIPPL is a tool that abuses a usermode only exploit to manipulate PPL processes on Windows

rpcfirewall

rtypes

A simple but useful project maybe help you reverse Windows.

sentinelbruh

Dirty PoC on how to abuse S1's VEH for Vectored Syscalls and Local Execution

shadow_syscall

convenient use of syscalls with a single line and a comfort wrapper, unfriendly for reverse engineer

shannon_modem_loader

shannonfirmware

Samples of Shannon baseband firmware for research purposes.

shothv

ShotHv

signthief

Windows PE Signature Thief in C++

sigscanner

Windows internal signature scanner

simplewhpdemo

Simple Demo of using Windows Hypervisor Platform

siren-hypervisor

skardriver

IOCTL Dispatch driver to rw mem and more, the last version was used all over the community so i deicded to reamek the usermode (and km ;)). This is meant to learn and hope u learn shit from the kernel mode documentation i did