iMonitor（冰镜 - 终端行为分析系统）

KDMapper is a simple tool that exploits iqvw64e.sys Intel driver to manually map non-signed drivers in memory

User Mode Windows Rootkit

Nidhogg is an all-in-one simple to use rootkit for red teams.

This map lists the essential techniques to bypass anti-virus and EDR

Process Hollowing in C++ (x86 / x64) - Process PE image replacement

Open-Source Shellcode & PE Packer

Transacted Hollowing - a PE injection technique, hybrid between ProcessHollowing and ProcessDoppelgänging

Process Herpaderping proof of concept, tool, and technical deep dive. Process Herpaderping bypasses security products by obscuring the intentions of a process.

Shellcode implementation of Reflective DLL Injection. Convert DLLs to position independent shellcode

Stealing Signatures and Making One Invalid Signature at a Time

Kernel shellcode injector

Tool for port forwarding & intranet proxy

Practice Go programming and implement CobaltStrike's Beacon in Go

基于libuv开发的内网穿透反向代理(Intranet penetration reverse proxy)

An injector that aims to be stealthy by using non suspicious API calls. Inspired by (https://github.com/FuzzySecurity/Sharp-Suite/tree/master/UrbanBishop)

Learn Python 3 Sample Code

http流量伪装的socks5代理

RandomX, CryptoNight and Argon2 CPU miner

moved to: https://github.com/alphaSeclab/awesome-reverse-engineering

This cheasheet is aimed at the CTF Players and Beginners to help them understand the fundamentals of Privilege Escalation with examples.

Simple obfuscation tool