Stars
A PoC for Early Cascade process injection technique.
PoC for a sleep obfuscation technique leveraging waitable timers to evade memory scanners.
The pack of imgui menus and loaders. Feel free to use
External Base for bypassing Shadow Regions in Valorant
Abusing mhyprotect to kill AVs / EDRs / XDRs / Protected Processes.
Achieve arbitrary kernel read/writes/function calling in Hypervisor-Protected Code Integrity (HVCI) protected environments calling without admin permissions or kernel drivers.
🤖 The free, Open Source alternative to OpenAI, Claude and others. Self-hosted and local-first. Drop-in replacement for OpenAI, running on consumer-grade hardware. No GPU required. Runs gguf, transf…
Implements dynamic Windows API resolution via hashing techniques to evade detection. Inspired by techniques mapped to MITRE ATT&CK T1055.012 (Process Injection: API Access).
Quickly search for references to a GUID in DLLs, EXEs, and drivers
Nidhogg is an all-in-one simple to use windows kernel rootkit.
A simple program running commands as TrustedInstaller without starting its service
Using NtCreateFile and NtDeviceIoControlFile to realize the function of winsock(利用NtCreateFile和NtDeviceIoControlFile 实现winsock的功能)
Dll memory redirection through Hook NtMapViewOfSection
Cheat for my own game SecureGame which uses a bootkit to hyperjack Hyper-V in order to access VBS enclave's memory
Minimalistic AMD-V/SVM hypervisor with memory introspection capabilities
Using Windows' own bootloader as a shim to bypass Secure Boot
Single-header, minimalistic, cross-platform hook library written in pure C
kernel mode spoofer disk and smbios, socket communication
Communicate between user-mode and kernel-mode through a swapped QWORD pointer argument.